> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of RB > Sent: Thursday, June 17, 2010 11:25 PM > To: rsyslog-users > Subject: Re: [rsyslog] feedback requested: NEW rsyslog.conf format > > On Thu, Jun 17, 2010 at 15:02, Rainer Gerhards > <[email protected]> wrote: > > Mmmh... I guess we are misunderstandig here. I talk about rule*sets*, > not > > rules (within rulesets). Or I get the sample wrong. I would creates > this > > scenario as follows: > > > > <ruleset name=rs> > > <rule...><action type=db...></rule> > > <rule...><action type=omfile file=worm...> </rule> > > </ruleset> > > > > <input type=relp ruleset=rs ... > > > <input type=udp ruleset=rs ... > > > <input type=tcp ruleset=rs ... > > > > > Note that each input has exactly one ruleset whereas the (single) > ruleset is > > used by three inputs. Thus we have 1:n rather than m:n. > > > > Misunderstanding or did I overlook something? > > Probably not, but assuming each individual rule could have independent > selectors (only send high-urgency messages to the database), I'm most > likely just not grasping what you intend by m:n. Then again, my uses > are relatively simple and at a cursory glance the current proposal > more than fits them.
I left the selectors out for brevity. I think you actually missed on level. At the top there are rulesets. These are composed out of multiple rules. Each rule than is composed of a filter (selector) and multiple actions. This hierarchy already exists in v5, but the top level is seldom used. I am talking about the relationship between inputs and rulsets (not rules). What I intended to say is that I don’t see a need that a single input can be bound to more than one ruleset. On the other hand, it is definitely necessary to have the ability to bind a ruleset to more than one input. I hope that clarifies. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
