Hi,
quoting the filter docs[1]:
A property-based filter must start with a colon in column 0. This tells
rsyslogd that it is the new filter type. The colon must be followed by
the property name, a comma, the name of the compare operation to carry
out, another comma and then the value to compare against. This value
must be quoted. There can be spaces and tabs between the commas.
Property names and compare operations are case-sensitive, so "msg"
works, while "MSG" is an invalid property name. In brief, the syntax is
as follows:
:property, [!]compare-operation, "value"
To find out the available properties, check out [2]. Then read up on [3]
for the ommysql syntax.
Untested example:
:fromhost-ip, isequal, "xxx.xxx.xxx.xxx" :ommysql:host:db:user:pass
Hope this helps,
John
[1] http://www.rsyslog.com/doc/rsyslog_conf_filter.html
[2] http://www.rsyslog.com/doc/property_replacer.html
[3] http://www.rsyslog.com/doc/rsyslog_mysql.html
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
