isn't the ruleset bound to the input, not the module? or am I remembering things
incorrectly.
David Lang
On Fri, 21 Mar 2014, Xuri Nagarin wrote:
Date: Fri, 21 Mar 2014 13:47:54 -0700
From: Xuri Nagarin <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: [rsyslog] Binding a ruleset per RELP port/instance
Hi,
I know, as of now, a ruleset is bound to the imrelp module so every
port that uses relp to listen will use the same ruleset.
In our use case, we have different business units where we collect
logs from and we allocate a port to each BU. We then create a specific
ruleset to deal with each BU's data types or sending agent (QRadar,
Splunk, Arcsight etc etc). So one ruleset to bind them all doesn't
work well.
Is a ruleset per port for RELP on the horizon?
Thanks,
Xuri
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
