Just one more re-confirmation: > What I'm looking for: > if $msg == 'This is really bad' happens 3 times in a row then > :ommail:;mailBody > > This would be nice but is not required since the 'This is really bad' > message in my case is very unique: > if ($msg == 'This is really bad' and $server == 'server' and $program > == 'program') happens 3 times in a row then :ommail:;mailBody
So you would actually use such a rule. If "this other thing is really bad" happened three times, the rule shall not trigger. Is this right? Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
