Rules

Rules have the final say in determining whether to post a syslog event, to which Output(s) to post the syslog event, and the class and severity for that event. Rules take effect based on Conditions that interrogate event Field data. Special fields allow you to specify general information about the event (when, who, day of week, et cetra). This list of special fields may include data from the journal entry “header” (not available for use in Rules for message queues - similarly, there may be data for messages not available for journals).

Conditions perform the evaluation. Fields can be compared to other Fields. Rules supply the values to use in the output event. Rules can specify the severity and proprietary “class” of the output event.