I'm running into problems trying to do filtering. it looks as if the log parsing is not properly filling in the properties.
what I've run into so far when I use the property 'programname' the content that I see is what I would expect in 'hostname' when I use the property 'hostname' the content that I see is what I would expect in 'fromhost' I haven't checked all the other properties, but my guess is that somehow rsyslog is off-by-one in filling them in. David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com

