Hi Luke, Not sure if it helps, but I'm trying to explain why the first one didn't work and now it works:
In the first config you had a condition, but no action next to it. So it did nothing. Now you have an action (@10.5.69.56). And in the first config, you were sending all logs (*.*) to the remote server. Best regards, Radu 2012/12/12 Luke Marrott <[email protected]> > Thanks for your help. > > I poked around some more and I got it working with this line: > > :msg,contains,"SYS-5-CONFIG" @10.5.69.56 > > :Luke Marrott > > > > On Wed, Dec 12, 2012 at 11:53 AM, Rainer Gerhards > <[email protected]>wrote: > > > I guess this is in syslogtag, not msg. > > > > Rainer > > > > > > Sent from phone, thus brief. > > > > Luke Marrott <[email protected]> hat geschrieben: > > I've been poking around on the website and looking through mailing list > > archives and I can't seem to get this working the way I want. > > > > I want to forward only messages containing: SYS-5-CONFIG > > > > So I did a configuration as follows, and it doesn't seem to filter > > anything. > > > > What am I doing wrong? > > > > :msg, contains, "SYS-5-CONFIG" > > > > > > *.* @10.5.69.56 > > > > > > > > Thanks! > > > > :Luke Marrott > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
