well one thing that I see is a problem is the & on a line by itself
that's like saying
if $msg contains 'Login' then
with no action following 'then'
That could be causing rsyslog to stop parsing the config file, what errors show
up during startup? you may need to start rsyslogd with the -dn flags to see all
the errors.
Also, I don't think this is the full config because you don't have any inputs
here, so with this config, rsyslog would never have any log messages to process.
David Lang
On Mon, 22 Jul 2013, jc_ruiz wrote:
Here is the full confi
The first if works but then the next if do not.
If the variables clear I'm sure this is what is happening then.
$ModLoad ommail
$ActionMailSMTPServer 192.168.1.25
$ActionMailFrom CH-RSYSLOG01
$ActionMailTo adminsyslog
$template mailSubject,"A syslog alert at %timegenerated% from %hostname%"
$template mailBody,"RSYSLOG Alert\r\nmsg='%msg%'"
$template mailBody1,"RSYSLOG Alert\r\nmsg='%msg%'"
$ActionMailSubject mailSubject
if $msg contains 'Login' then :ommail:;mailBody
&
if $msg contains 'Configured' then :ommail:;mailBody1
if $msg contains 'flapping' then :ommail:;mailBody
if $msg contains 'SPAN' then :ommail:;mailBody1
--
View this message in context:
http://rsyslog-rsyslog-users.1305293.n2.nabble.com/Multiple-Email-messages-filter-tp7581205p7581219.html
Sent from the rsyslog -- rsyslog-users mailing list archive at Nabble.com.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
