> > Is there any good argument that backs a n:m relationship? > > A syslogd that accepts UDP, TCP, and RELP feeds and dumps them both to > a database for immediate analysis/queries and to a WORM filesystem for > long-term archival.
Mmmh... I guess we are misunderstandig here. I talk about rule*sets*, not rules (within rulesets). Or I get the sample wrong. I would creates this scenario as follows: <ruleset name=rs> <rule...><action type=db...></rule> <rule...><action type=omfile file=worm...> </rule> </ruleset> <input type=relp ruleset=rs ... > <input type=udp ruleset=rs ... > <input type=tcp ruleset=rs ... > Note that each input has exactly one ruleset whereas the (single) ruleset is used by three inputs. Thus we have 1:n rather than m:n. Misunderstanding or did I overlook something? Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
