Thanks! I was actually somewhat copying a format I found on the page for those filtering conditions. But then I found another example with them all on the same line.
My next question is what would be the best way to do this for like three different conditions? Would the performance take a hit if I just did three different lines like the one I did with the different string on each one? :Luke Marrott On Thu, Dec 13, 2012 at 1:03 AM, Radu Gheorghe <[email protected]>wrote: > Hi Luke, > > Not sure if it helps, but I'm trying to explain why the first one didn't > work and now it works: > > In the first config you had a condition, but no action next to it. So it > did nothing. Now you have an action (@10.5.69.56). And in the first > config, > you were sending all logs (*.*) to the remote server. > > Best regards, > Radu > > > 2012/12/12 Luke Marrott <[email protected]> > > > Thanks for your help. > > > > I poked around some more and I got it working with this line: > > > > :msg,contains,"SYS-5-CONFIG" @10.5.69.56 > > > > :Luke Marrott > > > > > > > > On Wed, Dec 12, 2012 at 11:53 AM, Rainer Gerhards > > <[email protected]>wrote: > > > > > I guess this is in syslogtag, not msg. > > > > > > Rainer > > > > > > > > > Sent from phone, thus brief. > > > > > > Luke Marrott <[email protected]> hat geschrieben: > > > I've been poking around on the website and looking through mailing list > > > archives and I can't seem to get this working the way I want. > > > > > > I want to forward only messages containing: SYS-5-CONFIG > > > > > > So I did a configuration as follows, and it doesn't seem to filter > > > anything. > > > > > > What am I doing wrong? > > > > > > :msg, contains, "SYS-5-CONFIG" > > > > > > > > > *.* @10.5.69.56 > > > > > > > > > > > > Thanks! > > > > > > :Luke Marrott > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
