On Mon, 11 Jan 2010, Dirk H. Schulz wrote: > Hi folks, > > I am running two central logservers using rsyslog that several dozen > servers report to (mostly also rsyslog). > > The central logservers are writing everything into a database and > additionally into local logfiles. > > I would like to change configuration in a way that only local messages > are written to local logfiles, and all messages (local and received from > remote servers) into the database.
yes, I do something similar to this on my systems. All logs except local logs get written to local files, all local logs get sent over the network (at which point they then get picked up as remote logs), and all logs (local or remote) get sent to a remote system. :fromhost, !isequal, "127.0.0.1" /var/log/messages;TraditionalFormat :fromhost, isequal, "127.0.0.1" @192.168.1.8;TraditionalForwardFormat *.* @192.168.1.2 _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
