you definantly do not need to perform the test twice (once in the if..then and again as a facility/severity test), so your config will work, but so will
if ( $programname == 'sshd' ) then {
auth,authpriv.* action(type="omfwd"...)
}
with the v7 config optimizer, there is no longer a significant performace
difference between the two typs of tests, so you can nest them any way you
want. Either as separate tests as shown, or with the compound test of your
version.
David Lang
On Wednesday, November 13, 2013 11:47:42 AM PDT, Leggett, Torrance I. wrote:
Actually looking at my config I think I may have answered my
own last question. In it I have:
if ( $programname == 'sshd' ) and ( $syslogfacility-text ==
'auth' or $syslogfacility-text == 'authpriv' ) then {
auth,authpriv.* @someotherhost:514;RSYSLOG_TraditionalForwardFormat
}
And since that fwd is already in its own conditional block, I
probably need to just do:
if ( $programname == 'sshd' ) and ( $syslogfacility-text ==
'auth' or $syslogfacility-text == 'authpriv' ) then {
action( type="omfwd" ... )
}
On Nov 13, 2013, at 1:40 PM, Leggett, Torrance I.
<[email protected]> wrote:
I've never gotten real deep in the rsyslog configuration so I
have a few questions.
The ${MainMsg/Action}ResumeRetryCount seems to look like a
'legacy' style option, but I don't see the equivalent in the
ranier-script style:
action( type="omfwd"
target="127.0.0.1"
port="5544" ...
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
