How to config rsyslog's error log

[yfliuyanyan]

Expected behavior

We use rsyslog to collect our business logs, and send them to my fwd by relp. But sometimes, business logs are not sent to my fwd.
To find out the reason, I want to see the error log of rsyslog itself. But I don't know where it is and how to set it.
Any help? Thanks.

Environment

• rsyslog version: 8.36.0
• platform:
• for configuration questions/issues, include rsyslog.conf and included config files

[rgerhards]

Messages are reported to the syslog stream as syslog.=error. Done depending on config via journal or direct .

[yfliuyanyan]

@rgerhards Thanks for your reply.
But where can I find it?
Where can I config journal or direct?

[rgerhards]

post your full conf

[vonBork]

Check your /etc/rsyslog.conf file. At the begining you need to add

global(processInternalMessages="on")

to your file. Later in the Rules Part add the following lines

syslog.=error /var/log/rsyslog/rsyslog_error.log
& stop

Which means write every rsyslog message with loglevel error to file /var/log/rsyslog/rsyslog_error.log. The & and stop will stop sending these messages to /var/log/messages. At least if you define that rule before the /var/log/messages definition.