syslog.conf.regex

MSyslog是一个允许在Linux下运行的网络系统日志程序

# PASS only logs NOT containing the string 'connection reset by peer' to next module
*.emerg	%regex -v -m 'connection reset by peer' %classic root

# PASS only logs containing the string 'disk full' to next module
*.emerg	%regex -m 'disk full' %classic root

# PASS ONLY logs with host matching 'www'
*.emerg	%regex -h 'www' %classic /var/log/webserver

# PASS ONLY logs with host from 8pm to 9am  (20:00:00 to 09:00:00)
# and also matching 'root'
auth.info	%regex -v -t '^1' %regex -m 'root' %classic /var/log/webserver