Mailing List Archive: Filtering message types in rulesets

Is it possible to apply message filters to say, block/not log all message types of `INFO` and `DEBUG` from a specific rule?

For example:

Test.conf:
ruleset(name="vcsa20525" queue.type="linkedlist" queue.workerThreads="4" queue.workerThreadMinimumMessages="3000"){
action(type="omfile" file="/var/log/remote-syslog/vcsa.log")
}
input(type="imudp" port="20525" ruleset="vcsa20525")

Vcenter is notorious for not allowing syslog filtration or level setting on the appliance or source side. Support basically claims its all or nothing.
So the thought was to filter them on the Rsyslog side.. except I?m having no luck finding info or examples for filtering when using rulesets.

Thanks!

[Jamf]

Ben Hart
IT Systems Administrator II
100 Washington Ave S, Minneapolis, MN 55401
[Phone]
+00 1 989 424 0187
[Email]
ben.hart@jamf.com
[Web]
www.jamf.com<https://www.jamf.com>
[Facebook] [Twitter] [LinkedIn] [YouTube]

Hello!

It's the same as without ruleset I'd say.. As long as the source sets
severity right you should be able to use this:

ruleset(name="vcsa20525" queue.type="linkedlist" queue.workerThreads="4"
queue.workerThreadMinimumMessages="3000"){
if $syslogseverity-text != ['info', 'debug'] then {
action(type="omfile" file="/var/log/remote-syslog/vcsa.log")
}
}

I might be wrong wrt exact severity string values but overall usage is like
this. Alternatively, you may invert the condition and call `stop` to drop
the message.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Mailing List Archive

Mailing List Archive

Attached Files: