[rsyslog] logging wildcards

[Joe Williams]

Thanks David, that ended up working after changing the "or" to an "and".

Also I ended up finding a good example of this sort of configuration at 

http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory

-Joe


On Fri, 4 Sep 2009 13:51:38 +1000
David Gillies <DGillies at fairfaxdigital.com.au> wrote:

>  
> I think something like this should work:
> 
> if ( $syslogfacility-text != 'local0' ) or ( $syslogfacility-text !=
> 'local2' ) then file3
> 
> David Gillies
> Linux Systems engineer
> Digital Infrastructure Services
>  
> Fairfax Digital
> Level 2, 1 Darling Island Road
> Pyrmont NSW 2009
> 
> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com
> [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of Joe Williams
> Sent: Friday, 4 September 2009 1:45 PM To: rsyslog at lists.adiscon.com
> Subject: Re: [rsyslog] logging wildcards
> 
> 
> Sorry I think we are misunderstanding each other. What I am wanting
> to do is this:
> 
> ###
> 
> local0.* FILE1
> local2.* FILE2
> 
> *.* (but not local0.* or local2.*) FILE3
> 
> ###
> 
> Is that possible?
> 
> Thanks again.
> -Joe
> 
> 
> 
> On Thu, 3 Sep 2009 17:24:06 -0700 (PDT)
> david at lang.hm wrote:
> 
> > On Thu, 3 Sep 2009, Joe Williams wrote:
> > 
> > > I do not want everything to log to a single file, the local 
> > > facilities I would like to log to there own file and not be
> > > caught by a wildcard.
> > 
> > ahh, ok, you cannot say local*.* you would have to list 
> > local0.*,local1.*,.. to cover them all
> > 
> > there are 16 facility numbers, and by filtering out local0-local7
> > you are wanting to eliminate exactly half of them
> > 
> > as such it's probably just as easy to list all the ones you want to 
> > record as it is to say *.* and subtract half of them.
> > 
> > David Lang
> > 
> > > Thanks.
> > > -Joe
> > >
> > >
> > > On Thu, 3 Sep 2009 17:05:04 -0700 (PDT) david at lang.hm wrote:
> > >
> > >> On Thu, 3 Sep 2009, Joe Williams wrote:
> > >>
> > >>> Hello again,
> > >>>
> > >>> I am trying to log everything (*.*) to /var/log/syslog but 
> > >>> local*.*. I tried a couple different ways to do this but didn't 
> > >>> find a solution. Is this possible? I have a couple services I
> > >>> want to log to their own file rather than syslog, messages, etc.
> > >>
> > >> if you just do
> > >>
> > >> *.* /var/log/syslog
> > >>
> > >> that will write everything to that file
> > >>
> > >> I'm not sure what you are trying to say when you say 'but
> > >> local*.*' above.
> > >>
> > >> David Lang
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com
> > >
> > >
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com
> 
> 
> --
> Name: Joseph A. Williams
> Email: joe at joetify.com
> Blog: http://www.joeandmotorboat.com/
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
> 
> The information contained in this e-mail message and any accompanying
> files is or may be confidential. If you are not the intended
> recipient, any use, dissemination, reliance, forwarding, printing or
> copying of this e-mail or any attached files is unauthorised. This
> e-mail is subject to copyright. No part of it should be reproduced,
> adapted or communicated without the written consent of the copyright
> owner. If you have received this e-mail in error please advise the
> sender immediately by return e-mail or telephone and delete all
> copies. Fairfax does not guarantee the accuracy or completeness of
> any information contained in this e-mail or attached files. Internet
> communications are not secure, therefore Fairfax does not accept
> legal responsibility for the contents of this message or attached
> files. _______________________________________________ rsyslog
> mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com


-- 
Name: Joseph A. Williams
Email: joe at joetify.com
Blog: http://www.joeandmotorboat.com/