MonitorWare Knowledge Base

Hey everyone --

I'm trying to figure out if there is a way to limit the filter that happens... that is, that I don't want EVERY message filtered for a specific filter, but instead, only authpriv.* messages for example.

Can this be done? If so, how?

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

ummm... I guess you hit it. The filter rules are not at least as powerful as I would like them to be. Its on the list, but that doesn't help here

Let me have a deep look tomorrow, I think there is a work-around, but I don't have it at hand...

Rainer

Cool. It would lessen the amount of load of our centralized server significantly if we can do so. My bosses asked for notification when someone SU's to root... and it seems a lot easier to fuse a filter in rsyslog to do it than to edit each and every server's /etc/profile.

What can I do to help?

ah, I just go *the* idea. A hack, but... place te filters at the end of the file. Then, place a discard action "~" right in front of it. Discard anything except the facility/severity you need...