Thank you, truly appreciate! With your help I've managed to implement the logic.
template (name="PolKit" type="list") {
property(name="timereported" dateFormat="year")
constant(value=" ")
property(name="timereported" dateFormat="month")
constant(value=" ")
property(name="timereported" dateFormat="day")
constant(value=" ")
property(name="$!msg" spifno1stsp="on")
property(name="$!msg" droplastif="on")
constant(value="\n")
}
if ($programname == 'polkitd' then {
set $!msg = replace($msg, '/etc/polkit-1/rules.d/', '');
action(type="omfile" file="/var/log/polkit.log" template="PolKit")
stop
}
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
