I'm using: rsyslogd 7.6.1, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: No FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes Number of Bits in RainerScript integers: 64 Old filter format works: :hostname,!regex, "^.*\.gemalto\.com$" ~:fromhost-ip,isequal,"10.54.2.98" ~ But new one didn't works: if $fromhost-ip == '10.54.2.98' and not ($hostname regex '.*\.gemalto\.com') then ~
> From: [email protected] > To: [email protected] > Date: Tue, 14 Apr 2015 14:46:34 +0200 > Subject: Re: [rsyslog] rsyslog regex bre "or operator" > > Hello, > Do you have an exemple with if condition and a regex method ? > I must write it like this : > if $hostname !regex "^.*\.gemalto\.com$" or $hostname !regex "^dct.*$" then ~ > ? > THX in Advanced > > > Date: Fri, 10 Apr 2015 05:14:48 -0700 > > From: [email protected] > > To: [email protected] > > Subject: Re: [rsyslog] rsyslog regex bre "or operator" > > > > On Fri, 10 Apr 2015, gaelor couilleaux wrote: > > > > > Hello every body, > > > > > > I'm trying to filter with differents patten on hostname with regex BRE > > > method. > > > > > > I'm using http://www.rsyslog.com/regex/ tool. > > > > > > My problem is i have hostnames contains "gemalto.com" or "dct", normally > > > the rule i would like use: > > > > > > :hostname,!regex, "(^.*\.gemalto\.com$)|(^dct.*$)" ~ > > > > > > But didn't work > > > > test the regex here: http://www.rsyslog.com/regex/ > > > > Also, you may have to switch to the if then type of test. On v7 and newer > > it's > > as fast as the other style of test and allows more complex expressions > > > > David Lang > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
