This rsyslog rule forwards syslog and auth facilities to another host:

syslog,auth.*                                  @another-host

The following (taken from here) forwards syslogs conditional on fromhost:

:fromhost-ip, !isequal, @

Question: How can I combine the two? I'd like a rsyslog rule to the effect of "forward all syslog and auth syslogs to another-host if fromhost is not equal to otherlogserver's IP`"

I tried the following that did not seem to work:

:fromhost-ip, !isequal, syslog,auth.* @another-host

In general, I'm not sure how you're supposed to debug the validity of rsyslog configuration settings; I don't know whether the above is even semi-valid or utter nonsense, but restarting the rsyslog service did not produce an error.

1 Answer 1


I'm not sure if this is considered proper or elegant by those experienced with rsyslog configuration files, but this seemed to work:

if $fromhost-ip != '' and ($syslogfacility-text == 'syslog' or $syslogfacility-text == 'auth') then @another-host

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .