Re: [rsyslog] Selective Forwarding

2012-12-13 Thread Rainer Gerhards
> -Original Message- > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > boun...@lists.adiscon.com] On Behalf Of Luke Marrott > Sent: Thursday, December 13, 2012 5:35 PM > To: rsyslog-users > Subject: Re: [rsyslog] Selective Forwarding > > I'm curr

Re: [rsyslog] Selective Forwarding

2012-12-13 Thread Luke Marrott
ailto:rsyslog- > > boun...@lists.adiscon.com] On Behalf Of Luke Marrott > > Sent: Thursday, December 13, 2012 5:05 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] Selective Forwarding > > > > Thanks! > > > > I was actually somewhat copying a format I found on the pa

Re: [rsyslog] Selective Forwarding

2012-12-13 Thread Rainer Gerhards
Which version do you use? The answer depends on that. > -Original Message- > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > boun...@lists.adiscon.com] On Behalf Of Luke Marrott > Sent: Thursday, December 13, 2012 5:05 PM > To: rsyslog-users > Subject: Re: [

Re: [rsyslog] Selective Forwarding

2012-12-13 Thread Luke Marrott
Thanks! I was actually somewhat copying a format I found on the page for those filtering conditions. But then I found another example with them all on the same line. My next question is what would be the best way to do this for like three different conditions? Would the performance take a hit if

Re: [rsyslog] Selective Forwarding

2012-12-13 Thread Radu Gheorghe
Hi Luke, Not sure if it helps, but I'm trying to explain why the first one didn't work and now it works: In the first config you had a condition, but no action next to it. So it did nothing. Now you have an action (@10.5.69.56). And in the first config, you were sending all logs (*.*) to the remo

Re: [rsyslog] Selective Forwarding

2012-12-12 Thread Luke Marrott
Thanks for your help. I poked around some more and I got it working with this line: :msg,contains,"SYS-5-CONFIG" @10.5.69.56 :Luke Marrott On Wed, Dec 12, 2012 at 11:53 AM, Rainer Gerhards wrote: > I guess this is in syslogtag, not msg. > > Rainer > > > Sent from phone, thus brief. > > Luke

Re: [rsyslog] Selective Forwarding

2012-12-12 Thread Rainer Gerhards
I guess this is in syslogtag, not msg. Rainer Sent from phone, thus brief. Luke Marrott hat geschrieben: I've been poking around on the website and looking through mailing list archives and I can't seem to get this working the way I want. I want to forward only messages containing: SYS-5-CON

[rsyslog] Selective Forwarding

2012-12-12 Thread Luke Marrott
I've been poking around on the website and looking through mailing list archives and I can't seem to get this working the way I want. I want to forward only messages containing: SYS-5-CONFIG So I did a configuration as follows, and it doesn't seem to filter anything. What am I doing wrong? :msg