Thanks I will try that for each entries ...
RegardsHarry..
On Thursday, May 3, 2018, 10:36:07 AM EDT, Flo Rance <[email protected]>
wrote:
You should give a condition, otherwise it will stop processing for all
messages.
E.g. if $fromhost-ip contains '10..x.x.x' then stop
On Thu, May 3, 2018 at 3:55 PM, Haary rock via rsyslog
<[email protected]> wrote:
Sorry I am reposting since it got mangled the texts ..
the problem is if I use the &~ at the end of the line .. its doesn't stop
sending the logs to /var/log/messages ..
but if I use the "stop" at the end of the file .. its stops sending messages to
/var/log/messages completely .
&~ used to work on previous version of syslog ..but its not working on the
rsyslogd 8.24.0 (RHEL 7.0)
I have my .conf file here
#This will allow this server to log the remotely forwarded logs
$FileCreateMode 0664
$fileOwner xxxx
$FileGroup xxx
$dirOwner xxxx
#
$template FilenameTemplateOne,"/opt/ apps/syslog/%HOSTNAME%.log"
if $fromhost-ip startswith '192.168.' then -?FilenameTemplateOne
#
$template FilenameTemplateOne,"/opt/ apps/syslog/%HOSTNAME%.log"
if $fromhost-ip startswith '209.95.224.' then -?FilenameTemplateOne
#
if $fromhost-ip == '10.x.x.x’ then /opt/apps/syslog/Fw1.log
if $fromhost-ip == '10..x.x.x’ then /opt/apps/syslog/fw2.log
if $fromhost-ip == '10..x.x.x’ then /opt/apps/syslog/mainsw1.log
if $fromhost-ip == '10..x.x.x’' then /opt/apps/syslog/secswitch.log
stop
&~ used to work on previous version of syslog ..but its not working on the
rsyslogd 8.24.0 (RHEL 7.0)
it gives the warning when I restart the syslog
rsyslogd[25517]: warning: ~ action is deprecated, consider using the 'stop'
statement instead
Any help would be greatly appreciated
ThanksHaary. On Wednesday, May 2, 2018, 5:24:14 PM EDT, David Lang
<[email protected]> wrote:
On Wed, 2 May 2018, Haary rock via rsyslog wrote:
> #This will allow this server to log the remotely forwarded
> logs$FileCreateMode 0664$fileOwner netman$FileGroup cscworks$dirOwner
> netman#$template FilenameTemplateOne,"/opt/ apps/syslog/%HOSTNAME%.log"if
> $fromhost-ip startswith '192.x.' then -?FilenameTemplateOne#$ template
> FilenameTemplateOne,"/opt/ apps/syslog/%HOSTNAME%.log"if $fromhost-ip
> startswith 'x.x.x..' then -?FilenameTemplateOne#if $fromhost-ip == '10.x.x.1'
> then /opt/apps/syslog/Firewall1- admin.logif $fromhost-ip == '10.x.x.x' then
> /opt/apps/syslog/firewall- core.logif $fromhost-ip == '10.x.x.x' then
> /opt/apps/syslog/switch1.logif $fromhost-ip == '10.x.x.x' then
> /opt/apps/syslog/switch2- admin.log
> there are few more similar entries from all the Ip's I wanted to create the
> logs ..
> the problem is if I use the &~ at the end of the line .. its doesn't stop
> sending the logs to /var/log/messages ..
> but if I use the "stop" at the end of the file .. its stops sending messages
> to /var/log/messages completely .
> &~ used to work on previous version of syslog ..but its not working on the
> rsyslogd 8.24.0 (RHEL 7.0)
please retry your post, as you can see, it mangled the files you were posting
______________________________ _________________
rsyslog mailing list
http://lists.adiscon.net/ mailman/listinfo/rsyslog
http://www.rsyslog.com/ professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
