As a general rule, the first thing you should do if filters don't work the way
you expect them to is to write things out with the format RSYSLOG_DebugFormat
this shows you everything about what variables contain what values. 90% of the
time you aren't testing what you think you are :-)
Also, with rsyslog v7+ the config optimizer makes it so that if..then tests are
just as fast as the :var, test ones. so just pick what makes the resulting
config the easiest to understand
David Lang
On Fri, 15 Apr 2016, Stuart Kendrick wrote:
Ahhh, OK.
So this config line does suppress messages containing the string "mtp-probe"
:rawmsg, contains, "mtp-probe:" stop
Whereas this line does not:
:msg, contains, "mtp-probe:" stop
Thank you for the assistance,
--sk
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Rainer Gerhards
Sent: Friday, April 15, 2016 2:55 PM
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] discarding msgs
Ah, that's tag, not msg. If in doubt use rawmsg, but do so at the top if
rsyslog.conf.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
