[rsyslog-notify] Forum Thread: Re: rsyslog filter /dev/null - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25586#p25586

Message: 
----------
well, you write to the file before you do the test that discards the
message

as of v7+ rulesets can (and probably should be) specified as

ruleset(options, including queues) {
  actions in the ruleset
}

rather than

$start some ruleset
misc other things
some actions
some queue stuff that doesn't affect the ruleset
action affected by queue stuff
other actions or commands
$start some other ruleset
more stuff that looks just like above, but now has different meaning

not to mentions stuff that is in there before you first say what ruleset
you are working on (which is in the default ruleset, but then you define
the start of the default ruleset)

see <!-- m --><a class="postlink"
href="http://www.rsyslog.com/doc/master/rainerscript/queue_parameters.html">http://www.rsyslog.com/doc/master/raine
... eters.html</a><!-- m --> for how to specify queue settings for a
ruleset