rsyslog rule forwards
auth facilities to another host:
The following (taken from here) forwards syslogs conditional on fromhost:
:fromhost-ip, !isequal, 220.127.116.11 @18.104.22.168:514
Question: How can I combine the two? I'd like a rsyslog rule to the effect of "forward all
auth syslogs to
another-host if fromhost is not equal to otherlogserver's IP`"
I tried the following that did not seem to work:
:fromhost-ip, !isequal, 22.214.171.124 syslog,auth.* @another-host
In general, I'm not sure how you're supposed to debug the validity of rsyslog configuration settings; I don't know whether the above is even semi-valid or utter nonsense, but restarting the rsyslog service did not produce an error.