Sent from phone, thus brief. Cheltenham, Chris via rsyslog <[email protected]> schrieb am Mo., 30. Apr. 2018, 21:03:
> See below > > =========================== > > Thank You; > > Chris Cheltenham > Technology Services > The School District of Philadelphia > > Work # 215-400-5025 > Cell # 215-301-6571 > > -----Original Message----- > From: David Lang <[email protected]> > Sent: Monday, April 30, 2018 2:53 PM > To: Cheltenham, Chris <[email protected]> > Cc: Cheltenham, Chris via rsyslog <[email protected]> > Subject: RE: [rsyslog] excluding ip addresses > > the thing you do not seem to understand is that you have not been able to > show us any log from the source that you are wanting to block. > > -- I was showing you the rsyslog data from the client , not the server > side > > This may be because the machine has multiple IP addresses and it's > arriving from a different IP, it may be because you are relaying the > message, so fromhost-ip has the relay IP > -- Yes it is multi-homed > > but from what you have shown, nothing is arriving at the rsyslog machine > from the IP you are wanting to block. > > -- I see that as well > > We are trying to help figure out what is happening with the logs, but we > don't know your network, so we are trying to help you see what's happening > so that you can tell us. > > -- I understand I just cannot spend an inordinate amount of time on > something that's is really a luxury for us > -- Maybe I worded that reply and you got the wrong impression > > I'm sorry that you feel that the troubleshooting is too much bother, but > any other syslog daemon is going to have the same problem. If you block by > source IP, but messages aren't arriving from that source IP, they won't be > blocked. > > -- It is too much bother when I can grep -v those ip address out when > troubleshooting , it's just not that important to me I have other things > of more importance. > Yup, and that's the perfect reminder to abide to my policy to stop working on threads after the first obviously fruitless exchange. Unfortunately I had ignored it this time... But that'll keep me back on the right path :-) Rainer > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
