[rsyslog] Port based filtering

david at lang.hm david at lang.hm
Mon Feb 27 20:34:35 CET 2012

On Mon, 27 Feb 2012, Jerome Renard wrote:

> Hi,
> I have an Rsyslog instance which listens on several ports.
> I would like to do port based filtering. For example I would like to
> say "if $from-port == 1234 then do thus"
> I read the documentation page which lists available properties [1] but
> found none which exposes the port
> number. So I have the feeling I can not do port based filtering, am I
> correct or did I overlook something ?
> If I can not do port based filtering, is it possible to prepend the
> InputTCPServerRun port  in the syslog message so I
> can process it in an output module ?

you can't do that, but I think you can use rulesets to do what you are 
wanting. define a separate ruleset for each listening port and put the 
rules for that port inside that ruleset.

David Lang

More information about the rsyslog mailing list