Arh ok. I that case how do i scope the rate limit so that it only effects the one next line instead of everything from there on?
Thanks Mark On 16 Feb 2011 23:53, <[email protected]> wrote: > On Wed, 16 Feb 2011, Mark Olliver wrote: > >> The partial if was to try and clear the messages to stop them going to other >> logs. > > Ok, but that would not do it. > > If you eliminated the if line, then the &~ line would apply the match > criteria of the prior line and stop processing that log message > > but with the partial if line, rsyslog will see a syntax error, and > depending on exactly how it handles that error it coudl affect things > after that in the config. > > David Lang > >> On 16 Feb 2011 22:01, <[email protected]> wrote: >>> On Wed, 16 Feb 2011, Mark Olliver wrote: >>> >>>> Hi All, >>>> >>>> I have several program that i am using to send data to local6 i am >>>> using rsyslog to filter these to their own logs however, some data >>>> seems to be written to multiple logs. Do you have any ideas? >>>> >>>> >>>> if $programname == 'USERLOG' then /var/log/user.log >>>> &~ >>>> >>>> if $programname == 'FILERR' then /var/log/filerr.log >>>> $ModLoad ommail >>>> $ActionMailSMTPServer localhost >>>> $ActionMailFrom [email protected] >>>> $ActionMailTo [email protected] >>>> $template filerrSubject,"FILE ERROR %HOSTNAME%.example.com %timestamp%" >>>> $template filerrBody,"There is a file Error on Host: >>>> %HOSTNAME%.example.com\n%msg%" >>>> $template smsBody,"%programname%, 44711111111, %hostname% %rawmsg%\n" >>>> $ActionMailSubject filerrSubject >>>> $ActionExecOnlyOnceEveryInterval 50 >>>> if $programname == 'FILERR' then :ommail:;filerrBody >>>> $ModLoad omprog >>>> $actionomprogbinary /usr/bin/alert >>>> if $programname == 'FILERR' then :omprog:;smsBody >>>> >>>> if $programname =='FILERR' >>>> &~ >>> >>> this looks wrong >>> do you really mean to have this partial if statement? >>> >>> David Lang >>> >>>> >>>> >>>> Now data from program USERLOG correctly only goes into user.log Data >>>> from FILERR however, seems to go into filerr.log and also into my >>>> later defined local6.log. Any ideas why? >>>> >>>> Also $ActionExecOnlyOnceEveryInterval 50 seems to effect everything >>>> after that statement for that facility, Can i restrict it to only >>>> taking effect for this programname? Or just this one line below - then >>>> i could have different times for sms to email? >>>> >>>> Thanks >>>> >>>> Mark >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com >>>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
