rsyslog documentation is very unclear. I want to forward only errors from auditlog to the remote rsyslog server. The examples show:
# auditd audit.log $InputFileName /var/log/audit/audit.log $InputFileTag tag_audit_log: $InputFileStateFile audit_log $InputFileSeverity info $InputFileFacility local6 $InputRunFileMonitor
With "InputFileSeverity" set to info, does that mean ALL entries into audit log will show up as info including errors? Or if I set it to "error" does that mean all entries including info will show up as error level?
I only want to see errors forwarded. I feel I am really missing the underlying mechanics on how to set this simple configuration up.