> > a simpler way to do this is: > > if $syslogfacility-text == "local6" and $programname == "httpd" > then/var/log/httpd-access_log > & ~ > if $syslogfacility-text == "local7" and $programname == "httpd" > then/var/log/httpd-error_log > & ~ > > one important thing to note is that current versions of rsyslog don't > allow strings to be delimited by ' only by " this is being fixed in the > 6.3 branch, but will not be backported.
I like simple! Ok, I fixed the quotes thing...now all double quotes (I also added a space between "then" and the logfile path): if $syslogfacility-text == "local6" and $programname == "httpd" then /var/log/httpd/access_log & ~ if $syslogfacility-text == "local7" and $programname == "httpd" then /var/log/httpd/error_log & ~ but rsyslog (3.22.1) cannot even read the file now: Aug 3 12:03:00 kernel: imklog 3.22.1, log source = /proc/kmsg started. Aug 3 12:03:00 rsyslogd: [origin software="rsyslogd" swVersion="3.22.1" x-pid="9395" x-info="http://www.rsyslog.com";] (re)start Aug 3 12:03:00 rsyslogd: the last error occured in /etc/rsyslog.conf, line 48 Aug 3 12:03:00 rsyslogd: the last error occured in /etc/rsyslog.conf, line 50 Aug 3 12:03:00 rsyslogd-2123: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2123 ] What did I miss? TIA! _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
