It does ! 
Thank you a lot ! 

Regards, 
Nicolas Even 

----- Mail Original ----- 
De: "Rainer Gerhards" <[email protected]> 
À: "Nicolas Even" <[email protected]>, "rsyslog-users" 
<[email protected]> 
Envoyé: Lundi 20 Septembre 2010 15h04:06 GMT +01:00 Amsterdam / Berlin / Berne 
/ Rome / Stockholm / Vienne 
Objet: Re: [rsyslog] Several Actions associated to a single filter : Mail +File 

This should work: 

if $fromhost-ip == '192.168.254.29' \ 
and not ( \ 
$msg contains 'discard' \ 
or $msg contains 'discard2' \ 
)\ 
then :ommail:;MailBody 
& ?ErrorLogFile 

Rainer 

> -----Original Message----- 
> From: [email protected] [mailto:rsyslog- 
> [email protected]] On Behalf Of Nicolas Even 
> Sent: Monday, September 20, 2010 3:02 PM 
> To: [email protected] 
> Subject: [rsyslog] Several Actions associated to a single filter : Mail 
> +File 
> 
> 
> Hello, 
> 
> I would like to have several actions associated to one filter. 
> When an error is detected, I want to notify someone by mail but I also 
> want to keep that log in a special file. 
> 
> I succeded to write the log in a file, then I succeded to send the log 
> via ommail module. 
> But I want to do both actions. 
> 
> I tried it without success. 
> 
> 
> if $fromhost-ip == '192.168.254.29' \ 
> and not ( \ 
> $msg contains 'discard' \ 
> or $msg contains 'discard2' \ 
> )\ 
> then :ommail:;MailBody -?ErrorLogFile 
> 
> I saw interesting things here : 
> http://download.rsyslog.com/rainerscript2_rsyslog.conf 
> But I did not suceed to have the wanted behaviour. 
> 
> Someone can help ? 
> 
> regards, 
> Nicolas Even 
> _______________________________________________ 
> rsyslog mailing list 
> http://lists.adiscon.net/mailman/listinfo/rsyslog 
> http://www.rsyslog.com 
_______________________________________________ 
rsyslog mailing list 
http://lists.adiscon.net/mailman/listinfo/rsyslog 
http://www.rsyslog.com 
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Reply via email to