Is there a property based filter in rsyslog?
Property-based filters are unique to rsyslogd. They allow to filter on any property, like HOSTNAME, syslogtag and msg. A list of all currently-supported properties can be found in the property replacer documentation (but keep in mind that only the properties, not the replacer is supported).
What are the three types of conditionals in rsyslog?
Rsyslog supports three kinds of conditional logic: the if statement, classic BSD facility/priority selectors, and property filters. All three are statements that control the execution of a block, so they can be used at any point in the configuration — including within another conditional — and are interchangeable.
Which is the subtree in the rsyslog template?
With that type, the parameter subtree must be specified, which tells which subtree to use. For example template (name=”tpl1” type=”subtree” subtree=”$!”) includes all CEE data, while template (name=”tpl2” type=”subtree” subtree=”$!usr!tpl2”) includes only the subtree starting at $!usr!tpl2.
How are blocks separated in rsyslog.conf?
Rsyslogd supports BSD-style blocks inside rsyslog.conf. Each block of lines is separated from the previous block by a program or hostname specification. A block will only log messages corresponding to the most recent program and hostname specifications given.
Why do we use selector lines in rsyslog?
Selectors are the traditional way of filtering syslog messages. They have been kept in rsyslog with their original syntax, because it is well-known, highly effective and also needed for compatibility with stock syslogd configuration files. If you just need to filter based on priority and facility, you should do this with selector lines.
What does an asterisk mean in rsyslog ( 8 )?
In addition to the above mentioned names the rsyslogd (8) understands the following extensions: An asterisk (“*’‘) stands for all facilities or all priorities, depending on where it is used (before or after the period). The keyword none stands for no priority of the given facility.
Do You precede every priority in rsyslog?
Rsyslogd has a syntax extension to the original BSD source, that makes its use more intuitively. You may precede every priority with an equals sign (“=’‘) to specify only this single priority and not any of the above.