Hey rsyslog-users, Using rsyslog 5.8.10, I'm using the imfile module to monitor my apache logs and send them to a remote server:
$InputFileName /var/log/httpd/www.vhost.com-access.log $InputFileTag httpd $InputFileStateFile www.vhost.com-access.state $InputFileSeverity notice $InputFileFacility local2 $InputRunFileMonitor $InputFilePersistStateInterval 1000 and logs are being shipped off with this line: kern.*;*.info;authpriv.*;cron.*;*.emerg;local1.*;local2.* @@remote:514 On the remote server, I have rules for these messages, as well as a rule to recreate what goes into the /var/log/messages on the local host: if $programname == 'httpd' and $syslogseverity-text == 'notice' then -?httpd-access;RSYSLOG_FileFormat kern.*;*.info;*.emerg;cron.none -?syslog;RSYSLOG_FileFormat My httpd logs are reaching their proper destination, but they're also going into the syslog file. I find this strange, since what I've defined for syslog doesn't match my httpd messages. I've tried using discards to get rid of the messages before they reach syslog, but this didn't have an effect either. Might anyone be able to say why these messages are ending up where they are? Thanks, Chad _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
