Hi There,
I'm trying to stop messages from certain hosts from being forwarded from my syslog server but the filters seem to be stopping all forwarding rather than just from the IP's I want.
This was the original filter I used:
if $fromhost-ip != "127.0.0.1" and not ($fromhost-ip contains '10.x.x.x','10.x.x.x','10.x.x.x') then {
action(type="omfwd" Target="x.x.x.x" Port="514" Protocol="udp" )
I also tried this:
if ($fromhost-ip != "127.0.0.1" or $fromhost-ip != "10.x.x.x" or $fromhost-ip != '"10.x.x.x" or $fromhost-ip != "10.x.x.x") then {
action(type="omfwd" Target="x.x.x.x" Port="514" Protocol="udp" )
I've tried with single quotes and double quotes around the IP addresses but it made no difference. Any suggestions on this?
Cheers
Brian
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
I'm trying to stop messages from certain hosts from being forwarded from my syslog server but the filters seem to be stopping all forwarding rather than just from the IP's I want.
This was the original filter I used:
if $fromhost-ip != "127.0.0.1" and not ($fromhost-ip contains '10.x.x.x','10.x.x.x','10.x.x.x') then {
action(type="omfwd" Target="x.x.x.x" Port="514" Protocol="udp" )
I also tried this:
if ($fromhost-ip != "127.0.0.1" or $fromhost-ip != "10.x.x.x" or $fromhost-ip != '"10.x.x.x" or $fromhost-ip != "10.x.x.x") then {
action(type="omfwd" Target="x.x.x.x" Port="514" Protocol="udp" )
I've tried with single quotes and double quotes around the IP addresses but it made no difference. Any suggestions on this?
Cheers
Brian
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.