[rsyslog-notify] Forum Thread: Re: Filter and copy some to other server? - (Mode 'reply')

[noreply at adiscon.com]

User: rgerhards 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24585#p24585

Message: 
----------
You discard (throw away) messages in some filter (~ action). So these
messages are not available after this is done. If you want to forward
everything including these message, you must do the forwarding before the
message is discarded. Assuming this is all of rsyslog.conf that's of
interest, this would be one proper sequence:

[code:x81fbohe]
$template FILENAME,"/var/log/hosts/%HOSTNAME%/syslog.log"
*.* ?FILENAME

if $hostname contains 'list' and $msg contains 'extra' then
@syslog2.internal

$template RemoteHost,"/var/log_arhiiv/syslog.log"
if ($hostname != 'syslog.internal') then ?RemoteHost
& ~  # after this (discard), processing of this message stops
[/code:x81fbohe]
HTH
Rainer