0

I am trying to forward rsyslog with ;RSYSLOG_SyslogProtocol23Format It works fine for an all log forward: *.* @@syslogserver.com:6789;RSYSLOG_SyslogProtocol23Format

But does anyone know how it can be implemented on specific rules?

if ($msg contains_i and so on)<br>
 action(type="omfwd" target="syslogserver.com" port="6789" protocol="tcp"
            action.resumeRetryCount="-1"

Cheers!

Romeo Ninov
  • 5,263
  • 4
  • 20
  • 26
Henric Carlsson
  • 1

1 Answers1

0

I'm not sure what you mean by rules, I'm assuming you mean conditionals or filters.

A simple if statement can be done like this:

if $msg contains 'test' then
    action(type="omfwd" template="RSYSLOG_SyslogProtocol23Format" ...)

... which can also be chained:

if $programname == 'my_program' and $msg contains 'test' then
    action(type="omfwd" template="RSYSLOG_SyslogProtocol23Format" ...)

... or be done with a collection of statements:

if $programname == 'my_program' then {
    action(type="omfwd" ...)
    if $msg contains 'test' then
        action(type="omfwd" template="RSYSLOG_SyslogProtocol23Format" ...)
    else
        action(type="omfwd" ...)
}
eDonkey
  • 115
  • 6