Hello<br><br>I have a problem with syslog-ng using match() in my filters. Here is the part of my syslog-ng.cong:<br><br>"<br>######<br># sources<br><br># all known message sources<br>source s_all {<br> file("/etc/syslog-ng/logtest" follow_freq(1));<br>
};<br><br><br>######<br># destinations<br><br>destination d_apache {<br>file("/etc/syslog-ng/logapache");<br>};<br><br>destination d_system {<br>file("/etc/syslog-ng/logsystem");<br>};<br><br>destination d_autres {<br>
file("/etc/syslog-ng/logautres");<br>};<br><br>######<br># filters<br><br>filter f_apache {<br>match(apache);<br>};<br><br>filter f_system {<br>match(system);<br>};<br><br>filter f_autres {<br>match((?!apache));<br>
};<br><br><br>######<br># logs<br><br>log {<br>source(s_all);<br>filter(f_apache);<br>destination(d_apache);<br>};<br><br>log {<br>source(s_all);<br>filter(f_system);<br>destination(d_system);<br>};<br><br>log {<br>source(s_all);<br>
filter(f_autres);<br>destination(d_autres);<br>"<br><br>As you can see, I want to search in lines if the string apache is present, if system is present or if apache is not present. The first two filters are OK, but the third doesn't work. Can you help me to solve the problem?<br>
<br>Thanks.<br>