23 Jul
2015
23 Jul
'15
7:19 p.m.
Physically dragging the thread back on topic...
I really am going crazy, trying to deal with the hourly logs from the loghost. We've got 170+ servers and workstations... but a *very* large percentage of what's showing up is from his bloody new fedora 22, with its idiot systemd logging of *ever* selinux message to /var/log/messages.
I tried creating a rule, /etc/rsyslog.d/audit.conf, that reads:
if $msg contains "audit" and $msg,contains,'res=success' then -
but that seemed to send *everything* to /dev/null. That was my best guess, based on googling (yahooing?) and man pages. Can anyone tell me what's wrong with that syntax?
mark