Hi Tarkan, It depends on which rsyslog version you have and what your configuration looks like. If you have a pre-v7 rsyslog with something like:
*.* :omrelp:<sever>:<port>;<template> # and later *.* /var/log/messages You can change it to: *.* :omrelp:<sever>:<port>;<template> &~ #this stops processing those events processed by the action further # Probably makes sense if you have a conditional and you # don't send *everything* via RELP. Otherwise you may just # want to comment the /var/log/messages bit # and later *.* /var/log/messages If you're on v7 or later (recommended :p), you have the easier to read "stop" action. Like: action( type="omrelp"...) stop Best regards, Radu P.S. I see Cristian was faster :) I think his version would stop processing all messages after the "~" character, and you might as well make sure you don't have any actions after your omrelp action, if you only want to use omrelp. It's best to test and see :) -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ On Tue, Oct 21, 2014 at 10:53 AM, Erimer, Tarkan <[email protected] > wrote: > Hi all, > > We have a centralized rsyslog server that works with RELP. Clients > forwarding their logs just fine, but still keeping a local copy on the > (Linux) clients. So, we don't want logs to be stored locally after they > are successfully forwarded to rsyslog. What's the best way of doing > this ? > > Thanks, > > > Tarkan > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
