Like this? # "Bad Data" Alert ############################## ################################################# $ActionMailTo [email protected] $ActionMailFrom [email protected] $ActionMailSMTPServer localhost $ActionMailSubject mailSubjectBadData
$ActionExecOnlyOnceEveryInterval 300 if $msg contains 'Bad Data' then :ommail:;mailBody $ActionExecOnlyOnceEveryInterval 0 On Fri, Apr 12, 2013 at 7:06 AM, Rainer Gerhards <[email protected]>wrote: > On Fri, 2013-04-12 at 07:01 -0700, Paul Fontenot wrote: > > Can someone tell me if I am missing something in this configuration for > > ommail? > > > > # "Bad Data" Alert > > > ############################################################################### > > $ActionMailTo [email protected] > > $ActionMailFrom [email protected] > > $ActionMailSMTPServer localhost > > $ActionMailSubject mailSubjectBadData > > > > $ActionExecOnlyOnceEveryInterval 0 > > if $msg contains 'Bad Data' then :ommail:;mailBody > > > > If i change the $ActionExecOnlyOnceEveryInterval to anything other than > '0' > > my logfiles will update at the interval specified. Meaning, if I specify > > '300' then my logs update every 5 minutes. > this is probably not an auto-reset property (there is a *lot* of legacy in > the legacy conf system), so you need to reset it to 0 after the action. > > HTH > Rainer > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
