1 2 3 4 5 6 7 8 9 10 11 12 13
$IncludeConfig diag-common.conf template(name="outfmt" type="list") { property(name="$!usr!msgnum") constant(value="\n") } if $msg contains 'msgnum' then { set $!usr!msgnum = field($msg, 58, 2); if cnum($!usr!msgnum) >= 5000 then stop action(type="omfile" file="./rsyslog.out.log" template="outfmt") }