There are a couple of ways to do that, for example: local6.* ?mythtvFile & :omrelp:osgiliath.gondor:2514 & ~
Or *.* :omrelp:osgiliath.gondor:2514 # assume forward everything local6.* ?mythtvFile & ~ Note that "&" just replaces a filter and is used to chain actions together. It cannot be used as a filter itself. What is best depends on your volume/other filters... Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Stephan Seitz > Sent: Sunday, August 19, 2012 4:29 PM > To: rsyslog-users > Subject: [rsyslog] Question about filtering > > Hi! > > I have questions concerning filtering with rsyslog 5.8.11 (Debian/Testing). > > System A is my main PC. It receives syslog messages via RELP and stores > them in a PostgreSQL database. Besides that it’s running the MythTV > backend. > > System B is my notebook. It sends syslog messages via RELP to A. Besides > that it’s running the MythTV frontend. > > Since I don’t want to have the MythTV logs in my standard syslog files (e.g. > /var/log/syslog), I have the following filter on both A and B: > > $template mythtvFile,”/var/log/mythtv/%programname%.log” > local6.* ?mythtvFile > & ~ > > MythTV is the only application using local6, so no problems with other > applications, but because of the discard option „& ~” the messages are not > send to A or stored in the database. > If I remove the discard line, all messages are sent to A and stored in the > database, but I have them in /var/log/syslog as well, which I don’t want. > > Trying to add the line > & :omrelp:osgiliath.gondor:2514 > before the discard option (system B) does not work (rsyslog says it is an > error). > The same happens if I insert the line for the postgres database & > :ompgsql:<options> (system A). > > So how can I change my MythTV rules so that B sends the MythTV messages > to A via RELP and stores them local in the filesystem in /var/log/mythtv and A > stores the received messages (and its own MythTV messages) in > /var/log/mythtv and the database. > > Thanks for your help! > > Stephan > > -- > | Stephan Seitz E-Mail: [email protected] | > | Public Keys: http://fsing.rootsland.net/~stse/keys.html | _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
