Mailing List Archive

Include and exclude in same .conf?
Hey all, Is it possible to both log and exclude within the same .conf file?

I have the following:

# Create an additional socket in haproxy's chroot in order to allow logging via
# /dev/log to chroot'ed HAProxy processes
$AddUnixListenSocket /var/lib/haproxy/dev/log

# Send HAProxy messages to a dedicated logfile
:programname, startswith, "haproxy" {
/var/log/haproxy.log
stop
}

But we have LogicMonitor collectors that are checking the hosts, I?d like to not log connections in Haproxy from those source CIDR ranges.

Is this possible?

Thanks!
Ben
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Include and exclude in same .conf? [ In reply to ]
Yep. Instead of simply doing

{
  /var/log/haproxy.log
  stop
}

You can do

{
   if (whatever_fancy_condition_you_want) then
      stop
   else
   {
      /var/log/haproxy.log
      stop
   }
}

I'm not sure about possible missing semicolons!

On 30.01.2023 16:22, Ben Hart via rsyslog wrote:
> Hey all, Is it possible to both log and exclude within the same .conf file?
>
> I have the following:
>
> # Create an additional socket in haproxy's chroot in order to allow logging via
> # /dev/log to chroot'ed HAProxy processes
> $AddUnixListenSocket /var/lib/haproxy/dev/log
>
> # Send HAProxy messages to a dedicated logfile
> :programname, startswith, "haproxy" {
> /var/log/haproxy.log
> stop
> }
>
> But we have LogicMonitor collectors that are checking the hosts, I’d like to not log connections in Haproxy from those source CIDR ranges.
>
> Is this possible?
>
> Thanks!
> Ben
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.