The official documentation [
http://www.rsyslog.com/doc/rsconf1_includeconfig.html ] says:
"This directive allows to include other files into the main
configuration file. As soon as an IncludeConfig directive is found, the
contents of the new file is processed. IncludeConfigs can be nested.
Please note that from a logical point of view the files are merged.
Thus, if the include modifies some parameters (e.g.
$DynaFileChacheSize), these new parameters are in place for the
"calling" configuration file when the include is completed. To avoid any
side effects, do a $ResetConfigVariables after the $IncludeConfig. It
may also be a good idea to do a $ResetConfigVariables right at the start
of the include, so that the module knows exactly what it does. Of
course, one might specifically NOT do this to inherit parameters from
the main file. As always, use it as it best fits..."
Basically, all the files in [/etc/rsyslog.d] are cat'd together and
parsed into the runtime configuration.
Your configuration is telling rsyslog to send all messages to two
different servers.
If you add "& ~", only the first server will get everything, and the
second will get nothing.
You should look into $InputFileFacility and $InputFileSeverity
[http://www.rsyslog.com/doc/imfile.html] to create the selector line.
Ariel
On 2011-01-19 16:59, Raffael Marty wrote:
I have the following config:
/etc/rsyslog.d/loggly-dal-nginx-access-prod.conf
$ModLoad imfile
$InputFileName /var/log/nginx/access.log
$InputFileTag nginx-access:
$InputFileStateFile stat-nginx-access
$InputRunFileMonitor
*.* @@logs.loggly.com:11111
/etc/rsyslog.d/loggly-dal-nginx-error-prod.conf
$ModLoad imfile
$InputFileName /var/log/nginx/error.log
$InputFileTag nginx-error:
$InputFileStateFile stat-nginx-error
$InputRunFileMonitor
*.* @@logs.loggly.com:22222
Two files to monitor. Each file I want to send to a different TCP port on logs.loggly.com.
Problem is that both logs show up on both ports. How do I stop that behavior? Do I just add
the "& ~" at the end of each block?
Thanks!
Raffael
--
Raffael Marty Founder and COO @ Loggly
@zrlram about.me/raffy
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
