4

Once again, i found that Rsyslog is not as flexible as i expected...

My application logs to LOCAL5.* ( depending on the severity )

I would like to see on my centralized log server only LOCAL5.WARNING and above

I assumed and tested

local5.info            ~

However this means block LOCAL5.INFO and ABOVE

How do i make it block LOCAL5.INFO and BELOW ???

Suggestions please?

Arenstar
  • 3,602
  • 2
  • 25
  • 34

1 Answers1

3

It seems

if $syslogfacility-text == 'local5' and $syslogseverity >= '5' then ~

did the trick...

Arenstar
  • 3,602
  • 2
  • 25
  • 34
  • Glad you resolved this issue. Please be sure to mark your answer as "accepted" when you are able. – jscott Jul 20 '12 at 03:06