[syslog-ng] min and max message count condition in correlation actions
Gergely Nagy
algernon at balabit.hu
Sat Apr 13 14:32:01 CEST 2013
Evan Rempel <erempel at uvic.ca> writes:
> so the syntax would be
>
> <action condition="$(context-length) == $num">
>
> wher $num is some macro from the pattern used to match a line.
>
> Is that correct?
$num can be pretty much anything: a number, a macro, another template
function - it is entirely up to you. It does not need to be extracted
from the pattern, but that should work too.
--
|8]
More information about the syslog-ng
mailing list