Hi Sam, if you can provide me with a (partial) sample of your config, I could try to re-arrange it. You may can also mail it privately to me.
Rainer > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:rsyslog- > [EMAIL PROTECTED] On Behalf Of Kielek, Samuel > Sent: Friday, June 06, 2008 1:32 PM > To: rsyslog-users > Subject: Re: [rsyslog] Central loghost using RHEL5.2 rsyslog > > Yes, but I believe the issue is that the rsyslog that ships with RHEL5 > is from the v2-stable tree. For that config to work it would need to be > from the v3 tree. > > At this point I have just settled for having everything (local + > remote) > under one directory structure which is working nicely. > > -Sam > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Elisamuel Resto > Sent: Thursday, June 05, 2008 5:59 PM > To: [email protected] > Subject: Re: [rsyslog] Central loghost using RHEL5.2 rsyslog > > Kielek, Samuel wrote: > > Thanks, but I still don't know how to separate out the local and > remote > > logs. I tried using expression based filters but didn't have much > > success. For example these config lines: > > > > # Log remotely generated authpriv messages to /syslog > > $template r_secure, > > "/syslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/secure.log" > > if $source != 'localhost' and $syslogfacility-text == 'authpriv' then > > -?r_secure > > > > Cause these errors: > > > > Jun 5 14:24:27 ncldl38011 rsyslogd:unknown priority name "" > > Jun 5 14:24:27 ncldl38011 rsyslogd:the last error occured in > > /etc/rsyslog.conf, line 25 > > Jun 5 14:24:27 ncldl38011 rsyslogd:warning: selector line without > > actions will be discarded > > > > Not sure if it's something with my syntax or is it just that this > > version of rsyslog doesn't (fully) support this. I'm assuming it's > not > > supported since the error seems to indicate that it is interpreting > that > > expression filter line as a standard selector type filter. > > > > Thanks, > > Sam > </snip> > > Have you seen this: > http://wiki.rsyslog.com/index.php/Sysklogd_drop- > in_with_remote_logs_sepa > rated_by_dynamic_directory > > -- > Elisamuel Resto <[EMAIL PROTECTED]> > Source Mage Developer / http://sourcemage.org > GPG KEY: 18615F19 / http://simplysam.us > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
