On Thu, Nov 14, 2013 at 6:14 AM, David Lang <[email protected]> wrote:
> you definantly do not need to perform the test twice (once in the if..then
> and again as a facility/severity test), so your config will work, but so
> will
> if ( $programname == 'sshd' ) then {
> auth,authpriv.* action(type="omfwd"...)
> }
>
> with the v7 config optimizer, there is no longer a significant performace
> difference between the two typs of tests, so you can nest them any way you
> want.
Actually, for this case, the executed result should be almost equal.
Rainer
> Either as separate tests as shown, or with the compound test of your
> version.
>
> David Lang
>
>
> On Wednesday, November 13, 2013 11:47:42 AM PDT, Leggett, Torrance I.
> wrote:
>
>> Actually looking at my config I think I may have answered my own last
>> question. In it I have:
>>
>> if ( $programname == 'sshd' ) and ( $syslogfacility-text == 'auth' or
>> $syslogfacility-text == 'authpriv' ) then {
>> auth,authpriv.* @someotherhost:514;RSYSLOG_TraditionalForwardFormat
>> }
>>
>> And since that fwd is already in its own conditional block, I probably
>> need to just do:
>>
>> if ( $programname == 'sshd' ) and ( $syslogfacility-text == 'auth' or
>> $syslogfacility-text == 'authpriv' ) then {
>> action( type="omfwd" ... )
>> }
>>
>> On Nov 13, 2013, at 1:40 PM, Leggett, Torrance I. <[email protected]>
>> wrote:
>>
>> I've never gotten real deep in the rsyslog configuration so I have a few
>>> questions.
>>>
>>> The ${MainMsg/Action}ResumeRetryCount seems to look like a 'legacy'
>>> style option, but I don't see the equivalent in the ranier-script style:
>>>
>>> action( type="omfwd"
>>> target="127.0.0.1"
>>> port="5544" ...
>>>
>>
>>
>>
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
