Thanks David, that ended up working after changing the "or" to an "and".
Also I ended up finding a good example of this sort of configuration at http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory -Joe On Fri, 4 Sep 2009 13:51:38 +1000 David Gillies <[email protected]> wrote: > > I think something like this should work: > > if ( $syslogfacility-text != 'local0' ) or ( $syslogfacility-text != > 'local2' ) then file3 > > David Gillies > Linux Systems engineer > Digital Infrastructure Services > > Fairfax Digital > Level 2, 1 Darling Island Road > Pyrmont NSW 2009 > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Joe Williams > Sent: Friday, 4 September 2009 1:45 PM To: [email protected] > Subject: Re: [rsyslog] logging wildcards > > > Sorry I think we are misunderstanding each other. What I am wanting > to do is this: > > ### > > local0.* FILE1 > local2.* FILE2 > > *.* (but not local0.* or local2.*) FILE3 > > ### > > Is that possible? > > Thanks again. > -Joe > > > > On Thu, 3 Sep 2009 17:24:06 -0700 (PDT) > [email protected] wrote: > > > On Thu, 3 Sep 2009, Joe Williams wrote: > > > > > I do not want everything to log to a single file, the local > > > facilities I would like to log to there own file and not be > > > caught by a wildcard. > > > > ahh, ok, you cannot say local*.* you would have to list > > local0.*,local1.*,.. to cover them all > > > > there are 16 facility numbers, and by filtering out local0-local7 > > you are wanting to eliminate exactly half of them > > > > as such it's probably just as easy to list all the ones you want to > > record as it is to say *.* and subtract half of them. > > > > David Lang > > > > > Thanks. > > > -Joe > > > > > > > > > On Thu, 3 Sep 2009 17:05:04 -0700 (PDT) [email protected] wrote: > > > > > >> On Thu, 3 Sep 2009, Joe Williams wrote: > > >> > > >>> Hello again, > > >>> > > >>> I am trying to log everything (*.*) to /var/log/syslog but > > >>> local*.*. I tried a couple different ways to do this but didn't > > >>> find a solution. Is this possible? I have a couple services I > > >>> want to log to their own file rather than syslog, messages, etc. > > >> > > >> if you just do > > >> > > >> *.* /var/log/syslog > > >> > > >> that will write everything to that file > > >> > > >> I'm not sure what you are trying to say when you say 'but > > >> local*.*' above. > > >> > > >> David Lang > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com > > > > > > > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > -- > Name: Joseph A. Williams > Email: [email protected] > Blog: http://www.joeandmotorboat.com/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > > The information contained in this e-mail message and any accompanying > files is or may be confidential. If you are not the intended > recipient, any use, dissemination, reliance, forwarding, printing or > copying of this e-mail or any attached files is unauthorised. This > e-mail is subject to copyright. No part of it should be reproduced, > adapted or communicated without the written consent of the copyright > owner. If you have received this e-mail in error please advise the > sender immediately by return e-mail or telephone and delete all > copies. Fairfax does not guarantee the accuracy or completeness of > any information contained in this e-mail or attached files. Internet > communications are not secure, therefore Fairfax does not accept > legal responsibility for the contents of this message or attached > files. _______________________________________________ rsyslog > mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com -- Name: Joseph A. Williams Email: [email protected] Blog: http://www.joeandmotorboat.com/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
