[rsyslog-notify] Forum Thread: Re: Rsyslog Message duplicates - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24332#p24332

Message: 
----------
I don't understand, if you are just sending them the same place, you
shouldn't need to filter.

The reason for filtering is that you wanted them written to a particular
file and then NOT appear in files further down in the config.

so on the machine sending the logs, you can do

*.* @@10.x.x.x:514
if $programname == 'apache-access' then ~
if $programname == 'apache-errors' then ~

*.* /var/log/messages (or whatever else you want)

and the apache logs won't show up in messages, but will be sent to the
remote server (along with all of your other logs)

Then on the remote server, you will want to have something like

if $programname == 'apache-access' then /var/log/access.log
& ~
to write this data to the log and then not process it with any further
rules.

David Lang