You forgot the discard line. Try: $ModLoad imudp $RuleSet test1 *.* /var/log/testing/test1 & ~ $RuleSet test2 *.* /var/log/testing/test2 &~ $InputUDPServerBindRuleset test1 $UDPServerRun 20006 $InputUDPServerBindRuleset test2 $UDPServerRun 20008
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Jagga Soorma Sent: Friday, March 23, 2012 5:35 PM To: [email protected] Subject: [rsyslog] Port based filtering Hello, I have a requirement to listen to multiple udp ports on my syslog server and send logs based on the incoming port number to a specific log. I have been unable to do this and would appreciate any help with it. Here is what I am trying to do: - $ModLoad imudp $RuleSet test1 *.* /var/log/testing/test1 $RuleSet test2 *.* /var/log/testing/test2 $InputUDPServerBindRuleset test1 $UDPServerRun 20006 $InputUDPServerBindRuleset test2 $UDPServerRun 20008 - I am trying to send all logs that are coming into port 20006 on this server to /var/log/testing/test1 and all logs coming into port 20008 to /var/log/testing/test2. However, when I send a entry from client on both port 20006 or 20008 that message is being populated on both /var/log/testing/test1 and /var/log/testing/test2. Is there a way to seperate out these logs? Thanks in advance. -J _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
