I guess you meant : if $fromhost-ip == "2.2.2.2" then @192.168.0.1
Philippe Muller On Fri, Mar 8, 2013 at 2:10 PM, Radu Gheorghe <radu0gheor...@gmail.com>wrote: > Hi Clayton, > > Have a look here: > http://www.rsyslog.com/doc/rsyslog_conf_filter.html > > You can do something like: > > if 'fromhost-ip' == '2.2.2.2' then { > @192.168.0.1 > } > > > If you need a list of properties, like "fromhost-ip" is, there's more > documentation here: > http://www.rsyslog.com/doc/property_replacer.html > > Best regards, > Radu > > > 2013/3/6 Clayton Dukes <cdu...@gmail.com> > > > Hiya folks :-) > > > > I have a server running rsyslog v5.8.1 > > I need to check all incoming messages against a list of IP's. > > If the IP's match, then forward only severity level 0-2 to another host. > If > > they don't match, then forward sev 0-6. > > Can someone help me with this config? > > (Note that the list of IP's would be a combination of individual host > ip's > > as well as ranges.) > > > > > > What I have now: > > # provides UDP syslog reception > > $ModLoad imudp > > $UDPServerRun 514 > > # provides TCP syslog reception > > $ModLoad imtcp > > $InputTCPServerRun 514 > > > > Forward all > > *.* @192.168.190.34:514 > > > > > > > > ______________________________________________________________ > > > > Clayton Dukes > > ______________________________________________________________ > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
