<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style title="owaParaStyle"><!--P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
--></style>
</head>
<body ocsi="x">
<div style="FONT-FAMILY: Tahoma; DIRECTION: ltr; COLOR: #000000; FONT-SIZE: 13px">
<div></div>
<div dir="ltr"><font color="#000000" size="2" face="Tahoma">I must be doing something wrong or the syntax is really dependant on the program name now.</font></div>
<div dir="ltr"><font size="2" face="tahoma"></font> </div>
<div dir="ltr"><font size="2" face="tahoma"><font size="2">Orginally under the v2.1 build, t</font>he intent of the filter was to strip any incoming message going to the syslog-ng server from the data being sent from the syslog-ng client. There was no one specific
program attached to the incoming data. It could come from the client's syslog-ng side via logger command, apache data, kernel, etc.</font></div>
<div dir="ltr"><font size="2" face="tahoma"></font> </div>
<div dir="ltr"><font size="2" face="tahoma">Server-side syslog-ng.conf filter section:</font></div>
<div dir="ltr"> </div>
<div dir="ltr">filter M_audit { not match("Auditing" value("Audit daemon rotating log files") flags(ignore-case)); };<br>
filter M_repeat { not match("Repeating" value("last message repeated") flags(ignore-case)); };<br>
filter M_stats { not match("Stats" value("Log statistics") flags(ignore-case)); };<br>
</div>
<div dir="ltr"><font size="2" face="tahoma">On the client side, I would just do 'logger daemon' to send over the message to the syslog-ng server.</font></div>
<div dir="ltr"><font size="2" face="tahoma"></font> </div>
<div dir="ltr"><font size="2" face="tahoma">On the server side, running syslog-ng -d reveals this output:</font></div>
<div dir="ltr"><font size="2" face="tahoma"></font> </div>
<div dir="ltr"><font size="2" face="tahoma">Incoming log entry; line='<13>Sep 20 17:16:31 drupal root: daemon'<br>
Filter rule evaluation begins; filter_rule='M_audit'<br>
No such value known; value='Audit daemon rotating log files'<br>
Filter node evaluation result; filter_result='match'<br>
Filter rule evaluation result; filter_result='match', filter_rule='M_audit'<br>
Filter rule evaluation begins; filter_rule='M_repeat'<br>
No such value known; value='last message repeated'<br>
Filter node evaluation result; filter_result='match'<br>
Filter rule evaluation result; filter_result='match', filter_rule='M_repeat'<br>
Filter rule evaluation begins; filter_rule='M_stats'<br>
No such value known; value='Log statistics'<br>
Filter node evaluation result; filter_result='match'<br>
Filter rule evaluation result; filter_result='match', filter_rule='M_stats'<br>
</font></div>
<div dir="ltr"><font size="2" face="tahoma"><font face="tahoma"></font></font> </div>
<div dir="ltr"><font size="2" face="tahoma"><font face="tahoma">Server-side syslog output being seen in the data file:</font></font></div>
<div dir="ltr"><font size="2" face="tahoma"></font> </div>
<div dir="ltr"><font size="2" face="tahoma">Sep 20 17:16:31 drupal root: daemon</font></div>
<div dir="ltr"><font size="2" face="tahoma"><font face="tahoma"></font> </div>
</font>
<div dir="ltr"><font size="2" face="tahoma"><font face="tahoma"></font> </div>
</font></div>
<br>
<hr>
<font face="Arial" color="Gray" size="1">CONFIDENTIALITY NOTICE: This email and any attachments are intended solely for the use of the named recipient(s). This email may contain confidential and/or proprietary information of Scientific Research Corporation.
If you are not a named recipient, you are prohibited from reviewing, copying, using, disclosing or distributing to others the information in this email and attachments. If you believe you have received this email in error, please notify the sender immediately
and permanently delete the email, any attachments, and all copies thereof from any drives or storage media and destroy any printouts of the email or attachments.<br>
<br>
EXPORT COMPLIANCE NOTICE: This email and any attachments may contain technical data subject to U.S export restrictions under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Export or transfer of this technical
data and/or related information to any foreign person(s) or entity(ies), either within the U.S. or outside of the U.S., may require advance export authorization by the appropriate U.S. Government agency prior to export or transfer. In addition, technical data
may not be exported or transferred to certain countries or specified designated nationals identified by U.S. embargo controls without prior export authorization. By accepting this email and any attachments, all recipients confirm that they understand and will
comply with all applicable ITAR, EAR and embargo compliance requirements.<br>
</font>
</body>
</html>