On Thu, 8 Nov 2018, sophie.loewenthal--- via rsyslog wrote:
Hi,
This seems to work for me, but I'd be grateful if somebody would confirm this
is actually correct.
Dump all nrpe messages into a file, and once done discard.
* Legacy format
:programname, isequal, "nrpe" /app/rsyslog/messages.nrpe.all
:programname, isequal, "nrpe" &
* New format
if ( $programname == "nrpe" ) then {
action(type="omfile" file="/app/rsyslog/messages.nrpe.all"
flushOnTXEnd="off")
stop
}
This works, but I'll point out that the following also works
if ( $programname == "nrpe" ) then {
/app/rsyslog/messages.nrpe.all
stop
}
you don't have to switch everything to use action(), the general recommendation
is taht if it's a single line in the legacy format, and it's at least as clear
as the new format, go ahead and use the legacy format.
It's when you have things that are multiple lines of config in the old format
(setting lots of $foo lines and then having the line that they affect) that the
old format becomes confusing and you should switch to the new format. There are
also new features available in the action() syntax, but if the old format does
what you want, you aren't using the new feature :-)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
