simply use the right oder:
pseudocode conf:
*.* @forward
if (apachmsgs) then {
action()
stop
}...other rules...
HTH
Rainer
On Thu, 2013-02-07 at 12:43 +0000, Ben Bradley wrote:
> Hi everyone
>
> I have Apache logging to /bin/logger
> Then rsyslog takes these log messages, writes vhost-specific log files, then
> forwards over the network.
>
> However with my rsyslog config as it is currently, I'm finding that all the
> Apache logs are also ending up in /var/log/messages... which causes these log
> files to get very large very quickly.
> I'm still testing out various rsyslog configs and I'm using rsyslog v7 from
> the RPM repos.
>
> Here's my full rsyslog config... http://pastebin.com/Qe5yGjpf
>
> And I think the problem is this line, which is in the default config...
> # Log anything (except mail) of level info or higher.
> # Don't log private authentication messages!
> *.info;mail.none;authpriv.none;cron.none /var/log/messages
>
> I'm not dropping the Apache log lines after I've written them to
> vhost-specific log files as I also want them to be forwarded over the network.
>
> Is there a way to exclude my apache log template from that /var/log/messages
> rule but still allow them and all other log messages to run through the
> forwarding action?
>
> Cheers, Ben
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
