> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Luke Marrott > Sent: Thursday, December 13, 2012 5:35 PM > To: rsyslog-users > Subject: Re: [rsyslog] Selective Forwarding > > I'm currently running rsyslog version 5.8.10.
Then it is best to repeat the three lines. Rainer > > :Luke Marrott > > > > On Thu, Dec 13, 2012 at 9:31 AM, Rainer Gerhards > <[email protected]>wrote: > > > Which version do you use? The answer depends on that. > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Luke Marrott > > > Sent: Thursday, December 13, 2012 5:05 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] Selective Forwarding > > > > > > Thanks! > > > > > > I was actually somewhat copying a format I found on the page for > those > > > filtering conditions. But then I found another example with them > all on > > > the > > > same line. > > > > > > My next question is what would be the best way to do this for like > > > three > > > different conditions? Would the performance take a hit if I just > did > > > three > > > different lines like the one I did with the different string on > each > > > one? > > > > > > :Luke Marrott > > > > > > > > > > > > On Thu, Dec 13, 2012 at 1:03 AM, Radu Gheorghe > > > <[email protected]>wrote: > > > > > > > Hi Luke, > > > > > > > > Not sure if it helps, but I'm trying to explain why the first one > > > didn't > > > > work and now it works: > > > > > > > > In the first config you had a condition, but no action next to > it. So > > > it > > > > did nothing. Now you have an action (@10.5.69.56). And in the > first > > > > config, > > > > you were sending all logs (*.*) to the remote server. > > > > > > > > Best regards, > > > > Radu > > > > > > > > > > > > 2012/12/12 Luke Marrott <[email protected]> > > > > > > > > > Thanks for your help. > > > > > > > > > > I poked around some more and I got it working with this line: > > > > > > > > > > :msg,contains,"SYS-5-CONFIG" @10.5.69.56 > > > > > > > > > > :Luke Marrott > > > > > > > > > > > > > > > > > > > > On Wed, Dec 12, 2012 at 11:53 AM, Rainer Gerhards > > > > > <[email protected]>wrote: > > > > > > > > > > > I guess this is in syslogtag, not msg. > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > Sent from phone, thus brief. > > > > > > > > > > > > Luke Marrott <[email protected]> hat geschrieben: > > > > > > I've been poking around on the website and looking through > > > mailing list > > > > > > archives and I can't seem to get this working the way I want. > > > > > > > > > > > > I want to forward only messages containing: SYS-5-CONFIG > > > > > > > > > > > > So I did a configuration as follows, and it doesn't seem to > > > filter > > > > > > anything. > > > > > > > > > > > > What am I doing wrong? > > > > > > > > > > > > :msg, contains, "SYS-5-CONFIG" > > > > > > > > > > > > > > > > > > *.* @10.5.69.56 > > > > > > > > > > > > > > > > > > > > > > > > Thanks! > > > > > > > > > > > > :Luke Marrott > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com/professional-services/ > > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED > by a > > > > myriad > > > > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT > POST > > > if you > > > > > > DON'T LIKE THAT. > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com/professional-services/ > > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED > by a > > > > myriad > > > > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT > POST > > > if you > > > > > > DON'T LIKE THAT. > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com/professional-services/ > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by > a > > > myriad > > > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if > > > you > > > > > DON'T LIKE THAT. > > > > > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com/professional-services/ > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > > myriad > > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if > > > you > > > > DON'T LIKE THAT. > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT > POST > > > if you DON'T LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
