On Thu, 2013-02-07 at 14:12 +0000, Ben Bradley wrote: > On Thu, 7 Feb 2013 12:54:21 +0000 > Rainer Gerhards <[email protected]> wrote: > > > simply use the right oder: > > > > pseudocode conf: > > > > *.* @forward > > if (apachmsgs) then { > > action() > > stop > > }...other rules... > > > > HTH > > Rainer > > Ok I've moved my forwarding rule above the log message rules and added: > if $app-name == 'apache-access' and $syslogfacility-text == 'local0' and > $syslogseverity-text == 'info' then ~ > if $app-name == 'apache-error' and $syslogfacility-text == 'local0' and > $syslogseverity-text == 'err' then ~ > So they don't get processed by the RULES steps > > Is there a referenceor examples for doing the syntax you mention above though? See http://www.rsyslog.com/doc/rsyslog_conf_filter.html
There are also examples in the FAQ section, other doc pages and my blog (http://blog.gerhards.net ) HTH Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
