[rsyslog-notify] Forum Thread: Re: pmaixforwardedfrom configuration - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25026#p25026

Message: 
----------
I think the right thing for you to do is to eliminate any references to
rulesets. I think you are just confusing yourself by trying to make use of
them

to use the parser modules you need to define all the parsers that you want
to run. pmaisforwardedfrom alone isn't enough, it just fixes up the raw
message so that the standard parser can then handle it, so you should also
have the rfc3195 (or whatever it is) parser defined in the parser stack as
well. see <!-- m --><a class="postlink"
href="http://www.rsyslog.com/how-to-use-a-parser-module/">http://www.rsyslog.com/how-to-use-a-parser-module/</a><!--
m --> for an example