mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-16 19:10:40 +01:00
15 lines
946 B
Plaintext
15 lines
946 B
Plaintext
rule=WIN:<%n1:number%>1 %-:date-rfc5424% %n2:word% %v_tag:word% - - - %v_svc:word% %v_ret:word% %v_os:word% %v_msg:rest%
|
|
annotate=WIN:+v_analytics_prefix="EvntSLog: "
|
|
|
|
rule=ESX:<%-:number%>%-:date-rfc5424% %-:word% %v_tag:char-to:\x3a%: %v_msg:rest%
|
|
annotate=ESX:+v_svc="SER2"
|
|
annotate=ESX:+v_ret="Y01"
|
|
annotate=ESX:+v_file="esx"
|
|
annotate=ESX:+v_os="ESX"
|
|
|
|
rule=LNX:<%-:number%>%-:date-rfc3164% %v_hostname:word% %v_tag:char-to:\x3a%: {%v_svc:char-to:\x2e%.%v_file:word% %v_ret:word% %v_os:word% [%v_forward:char-to:\x5d%]} %v_msg:rest%
|
|
rule=LNX:<%-:number%>%-:date-rfc3164% %v_hostname:word% %v_tag:char-to:\x20% {%v_svc:char-to:\x2e%.%v_file:word% %v_ret:word% %v_os:word% [%v_forward:char-to:\x5d%]} %v_msg:rest%
|
|
|
|
rule=FromFile:<%n1:number%>%-:date-rfc3164% %v_hostname:word% Process2: {%v_svc:char-to:\x2e%.%-:word% %v_ret:word% %v_os:word% [%v_forward:char-to:\x5d%]} (/%v_file:char-to:\x29%) %v_msg:rest%
|
|
annotate=FromFile:+v_tag="Process2"
|