After looking at the actual contents of the database for a clue, what I ended up doing was changing /etc/rsyslog.d/mysql.conf to this:
:fromhost,!regex,"^serverhostname$" :ommysql:localhost,rsyslogmysql,dbuser,dbpassword & ~ Now it does exactly what I want. On 6/14/2010 10:34 AM, Shawn Heisey wrote: > I am replacing my central monitoring server, which is currently running > syslog-ng, with another based on Debian lenny and its default rsyslog. > The current system logs all remote syslog sources to a separate > directory and splits it out into subdirectories by source host. All > local sources are sent to /var/log like a normal syslog configuration. > This is an extremely easy configuration with syslog-ng. > > With rsyslog, I'm interested in logging all remote sources to only > mysql, and all local sources to the standard files in /var/log. I got > the mysql set up, but everything gets logged to both locations. I'm OK > with local data being in both places, but I definitely do not want the > remote data in /var/log. > > I have been searching the mailing list and trying to understand the > documentation, but I cannot figure this out. Can someone help? _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
