Which version do you use? The answer depends on that.
> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Luke Marrott > Sent: Thursday, December 13, 2012 5:05 PM > To: rsyslog-users > Subject: Re: [rsyslog] Selective Forwarding > > Thanks! > > I was actually somewhat copying a format I found on the page for those > filtering conditions. But then I found another example with them all on > the > same line. > > My next question is what would be the best way to do this for like > three > different conditions? Would the performance take a hit if I just did > three > different lines like the one I did with the different string on each > one? > > :Luke Marrott > > > > On Thu, Dec 13, 2012 at 1:03 AM, Radu Gheorghe > <[email protected]>wrote: > > > Hi Luke, > > > > Not sure if it helps, but I'm trying to explain why the first one > didn't > > work and now it works: > > > > In the first config you had a condition, but no action next to it. So > it > > did nothing. Now you have an action (@10.5.69.56). And in the first > > config, > > you were sending all logs (*.*) to the remote server. > > > > Best regards, > > Radu > > > > > > 2012/12/12 Luke Marrott <[email protected]> > > > > > Thanks for your help. > > > > > > I poked around some more and I got it working with this line: > > > > > > :msg,contains,"SYS-5-CONFIG" @10.5.69.56 > > > > > > :Luke Marrott > > > > > > > > > > > > On Wed, Dec 12, 2012 at 11:53 AM, Rainer Gerhards > > > <[email protected]>wrote: > > > > > > > I guess this is in syslogtag, not msg. > > > > > > > > Rainer > > > > > > > > > > > > Sent from phone, thus brief. > > > > > > > > Luke Marrott <[email protected]> hat geschrieben: > > > > I've been poking around on the website and looking through > mailing list > > > > archives and I can't seem to get this working the way I want. > > > > > > > > I want to forward only messages containing: SYS-5-CONFIG > > > > > > > > So I did a configuration as follows, and it doesn't seem to > filter > > > > anything. > > > > > > > > What am I doing wrong? > > > > > > > > :msg, contains, "SYS-5-CONFIG" > > > > > > > > > > > > *.* @10.5.69.56 > > > > > > > > > > > > > > > > Thanks! > > > > > > > > :Luke Marrott > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com/professional-services/ > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > myriad > > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you > > > > DON'T LIKE THAT. > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com/professional-services/ > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > myriad > > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you > > > > DON'T LIKE THAT. > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
