<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><DIV>Hello,</DIV><DIV><BR class="khtml-block-placeholder"></DIV>This is on a Debian system with syslog-ng 1.6.5-2.2.<DIV><BR class="khtml-block-placeholder"></DIV><DIV>Is there any way to filter on the log timestamp? For example, suppose I </DIV><DIV>have a (machine|program) that reboots once a day at 0400, and I don't</DIV><DIV>want to log those events. I'd like to be able to set up a filter something</DIV><DIV>like this ...</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><FONT class="Apple-style-span" face="Courier">filter match_dailyreboot {</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier"> not (match("04:0[0-1]:[0-9][0-9]") </FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier"> and program("foo") </FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier"> and (match("Starting a brand new workday")</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier"> or match("*many annoying daily restart message*")</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier"> )</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier"> );</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier"></FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier">};</FONT></DIV><DIV><FONT class="Apple-style-span" face="Courier"><BR class="khtml-block-placeholder"></FONT></DIV><DIV>But as I understand the rules, match() only matches on the message.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span">Is there any way in the 1.6.* series to filter on time and other bits?</SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>-dean takemori</DIV></BODY></HTML>