Strike the last update - looks like there were some other problems or conflicts caused by various other things I had been trying, so I cleaned up and just added the entry you suggested.
We now have some entries in the /var/log/debugfile as follows - here's 2 typical entries for hosts we need to get 2 separate directories by hostname or IP logs for: Debug line with all properties: FROMHOST: 'iss-delta-cs1', fromhost-ip: '10.10.20.25', HOSTNAME: 'ISS-DELTA-CS1', PRI: 149, syslogtag 'Service_Control_Manager:', programname: 'Service_Control_Manager', APP-NAME: 'Service_Control_Manager', PROCID: '-', MSGID: '-', TIMESTAMP: 'Mar 4 13:50:44', STRUCTURED-DATA: '-', msg: ' 7036: The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state.' escaped msg: ' 7036: The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state.' inputname: imudp rawmsg: '<149>Mar 4 13:50:44 ISS-DELTA-CS1 Service_Control_Manager: 7036: The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state.' $!: $.: $/: Debug line with all properties: FROMHOST: 'iss-delta-cs2', fromhost-ip: '10.10.20.19', HOSTNAME: 'ISS-DELTA-CS2', PRI: 149, syslogtag 'Service_Control_Manager:', programname: 'Service_Control_Manager', APP-NAME: 'Service_Control_Manager', PROCID: '-', MSGID: '-', TIMESTAMP: 'Mar 4 14:00:00', STRUCTURED-DATA: '-', msg: ' 7036: The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.' escaped msg: ' 7036: The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.' inputname: imudp rawmsg: '<149>Mar 4 14:00:00 ISS-DELTA-CS2 Service_Control_Manager: 7036: The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.' $!: $.: $/: much the same in both cases as you can see. -- Sent from: http://rsyslog-users.1305293.n2.nabble.com/ _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
