David, That may be the key this entire issue. I will try it on the server side.
However, we are moving to graylog , or possibly and I was trying to filer it from the client side its being routed to two different servers at the moment. =========================== Thank You; Chris Cheltenham Technology Services The School District of Philadelphia Work # 215-400-5025 Cell # 215-301-6571 -----Original Message----- From: David Lang <[email protected]> Sent: Monday, April 30, 2018 5:07 PM To: Cheltenham, Chris <[email protected]> Cc: Cheltenham, Chris via rsyslog <[email protected]> Subject: RE: [rsyslog] excluding ip addresses On Mon, 30 Apr 2018, Cheltenham, Chris wrote: > -----Original Message----- > From: David Lang <[email protected]> > > the thing you do not seem to understand is that you have not been able > to show us any log from the source that you are wanting to block. > > -- I was showing you the rsyslog data from the client , not the > server side ahh, we were assuming that you were showing us data from the server side, since it only makes sense to filter on the server side (on the sending side, fromhost-ip is going to be 127.0.0.1, not the network IP) > We are trying to help figure out what is happening with the logs, but > we don't know your network, so we are trying to help you see what's > happening so that you can tell us. > > -- I understand I just cannot spend an inordinate amount of time on > something that's is really a luxury for us > -- Maybe I worded that reply and you got the wrong impression Part of the reason I was spending the time was to teach you the troubleshooting method :-) As you start using the more advanced features, there are going to be more times when the result is not what you initially expect, so the method of looking at the logs in the debug format to see what you actually have there (as opposed to what you expect to have there) is required. good luck, and post again if you have other issues David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
