You can also use the flags(final) tag in your log statement to prevent matched logs from also being written to any log statements below it. Put it in your 'specifically filtered' log statement, defined *above* your 'main' log statement.<div>
<br></div><div>log {</div><div>source(s_all);</div><div>filter(f_specific_filter);</div><div>destination(d_specific_log);</div><div>flags(final);</div><div>}</div><div><br></div><div>log {</div><div>source(s_all);</div><div>
destination(d_everything_else);</div><div>}<br><br><div class="gmail_quote">On Thu, Jan 21, 2010 at 12:58 PM, Siem Korteweg <span dir="ltr"><<a href="mailto:Siem.Korteweg@qnh.nl">Siem.Korteweg@qnh.nl</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Paul,<br>
<br>
use the keyword "not" in your filter:<br>
<br>
filter notmail { not facility(mail); }<br>
<br>
regards,<br>
Siem<br>
<br>
-----Oorspronkelijk bericht-----<br>
Van: <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a> namens PAUL WILLIAMSON<br>
Verzonden: do 21-1-2010 21:48<br>
Aan: <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
Onderwerp: [syslog-ng] Log all msgs but a specific filter<br>
<div class="im"><br>
I need to log all messages except for a specific filter. I have the filter<br>
defined<br>
and these messages are getting logged to a separate file. However, I have<br>
one<br>
"main" log file where I do all my other processing. How can I include that<br>
filter in my destination so that it drops those specific messages from<br>
getting<br>
logged?<br>
<br>
Thanks,<br>
Paul<br>
<br>
______________________________________________________________________<br>
</div><div><div></div><div class="h5">This email has been scanned by the MessageLabs Email Security System.<br>
For more information please visit <a href="http://www.messagelabs.com/email" target="_blank">http://www.messagelabs.com/email</a><br>
______________________________________________________________________</div></div><br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Lance Laursen<br>Demonware Systems Engineer<br>
</div>