[rsyslog-notify] Forum Thread: Re: Filter: Only log local for specific action - (Mode 'reply')

[noreply at adiscon.com]

User: AirOnSkin 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26879#p26879

Message: 
----------
So it has been almost a year since I asked the question above and because
of various reasons I wasn't able to work on it since now.

Thank you dlang for explaining the possibilities.

After reading the
[url=http://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html:3u1f8wwm]documentation
on rulesets[/url:3u1f8wwm] it was quite straight forward to configure the
remote input to use the DynFile template only.
I'm posting both config snippets for future people visiting this thread...

Before:
[code:3u1f8wwm]
# /etc/rsyslog.d/03_log-reception.conf

# MODULES
module(load="imrelp")
input(type="imrelp" port="2514" tls="on")

# TEMPLATES
template(name="DynFile" type="string"
 
string="/var/local/syslog/%HOSTNAME%/%SYSLOGFACILITY-TEXT%/%$YEAR%-%$MONTH%/%$DAY%"
)

# RULES
*.* action(type="omfile" dynaFile="DynFile")
[/code:3u1f8wwm]

After:
[code:3u1f8wwm]
# /etc/rsyslog.d/03_log-reception.conf

# MODULES
module(load="imrelp")
input(type="imrelp" port="2514" tls="on" ruleset="remoteHosts")

# TEMPLATES
template(name="DynFile" type="string"
 
string="/var/local/syslog/%HOSTNAME%/%SYSLOGFACILITY-TEXT%/%$YEAR%-%$MONTH%/%$DAY%"
)

# RULES
ruleset(name="remoteHosts"){
  action(type="omfile" dynaFile="DynFile")
}
[/code:3u1f8wwm]

Cheers,
Stefan