[rsyslog] omrelp and filtering

David Lang david at lang.hm
Wed May 3 22:48:46 CEST 2017


On Wed, 3 May 2017, Stuart Longland wrote:

> Hi Rainer,
> On 03/05/17 20:31, Rainer Gerhards wrote:
>> well, it is
>>
>> filter action
>>
>> for any part, you can pick whatever you like.
>>
>> so
>>
>> *.* action()
>>
>> works. Filter syntax is here:
>>
>> http://www.rsyslog.com/doc/v8-stable/configuration/filters.html
>
> Ahh okay, I wasn't sure so thought I'd ask the silly question.  I had
> read the page you had linked to, but didn't see anything using the newer
> syntax so assumed the two weren't compatible.
>
> I shall keep that in mind, as we'll have a need to filter all but the
> most severe messages in the near future.

with new versions, you can still use all the old syntaxes, they just work better 
:-)

you also have the ability to define multiple actions

*.* {
   action()
   action()
}

or

if ... then {
   action()
   action()
}

David Lang


More information about the rsyslog mailing list