[syslog-ng] min and max message count condition in correlation actions

Gergely Nagy algernon at balabit.hu
Sat Apr 13 14:32:01 CEST 2013


Evan Rempel <erempel at uvic.ca> writes:

> so the syntax would be
>
> <action condition="$(context-length) == $num">
>
> wher $num is some macro from the pattern used to match a line.
>
> Is that correct?

$num can be pretty much anything: a number, a macro, another template
function - it is entirely up to you. It does not need to be extracted
from the pattern, but that should work too.

-- 
|8]



More information about the syslog-ng mailing list