<font size=2 face="sans-serif">I believe it does, but I use it just in
case :)</font>
<br>
<br>
<br><font size=2 face="sans-serif">Thanks, Frank</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">"Lay, James"
<james.lay@wincofoods.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">"Syslog-ng users'
and developers' mailing list" <syslog-ng@lists.balabit.hu></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">11/08/2011 09:48 AM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [syslog-ng]
Quick filter question</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">syslog-ng-bounces@lists.balabit.hu</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 color=#004080 face="Calibri">Hi Frank,</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">Thanks for the quick response…my
last little bit is, I was under the impression that the message() directive
automatically assumed the value was already in the message only, and value()
wasn’t required? Am I off on this? Thanks again.</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">James</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 face="Tahoma"><b>From:</b> syslog-ng-bounces@lists.balabit.hu
[</font><a href="mailto:syslog-ng-bounces@lists.balabit.hu"><font size=2 face="Tahoma">mailto:syslog-ng-bounces@lists.balabit.hu</font></a><font size=2 face="Tahoma">]
<b>On Behalf Of </b>Frank Collette<b><br>
Sent:</b> Tuesday, November 08, 2011 8:36 AM<b><br>
To:</b> Syslog-ng users' and developers' mailing list<b><br>
Subject:</b> Re: [syslog-ng] Quick filter question</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=2 face="Calibri"><br>
filter f_firewall {</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
not ( <br>
program("firewall"
flags(ignore-case)) and</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
message("169\.254\.[0-9]+\.[0-9]+"
value("MESSAGE"));</font><font size=3 face="Times New Roman">
</font><font size=2 face="Arial"><br>
)</font><font size=3 face="Times New Roman">
</font><font size=2 face="Calibri"><br>
};</font><font size=3 face="Times New Roman"> <br>
<br>
</font><font size=2 face="Arial"><br>
Thanks,</font><font size=3 face="Times New Roman"> </font><font size=2 face="Arial"><br>
<br>
Frank E. Collette IV</font><font size=3 face="Times New Roman"> </font><font size=2 face="Arial"><br>
Technical Services<br>
Systems Administrator II<br>
Trustmark National Bank<br>
Office: 601-208-7517</font><font size=3 face="Times New Roman"> </font><font size=2 face="Arial"><br>
Fax: 601-208-6105</font><font size=3 face="Times New Roman"> </font><font size=2 color=blue face="Arial"><u><br>
</u></font><a href=mailto:fcollette@trustmark.com><font size=2 color=blue face="Arial"><u>fcollette@trustmark.com</u></font></a><font size=3 face="Times New Roman">
<br>
<br>
<br>
</font><font size=1 color=#5f5f5f face="Arial"><br>
From: </font><font size=1 face="Arial">"Lay,
James" <</font><a href=mailto:james.lay@wincofoods.com><font size=1 color=blue face="Arial"><u>james.lay@wincofoods.com</u></font></a><font size=1 face="Arial">></font><font size=3 face="Times New Roman">
</font><font size=1 color=#5f5f5f face="Arial"><br>
To: </font><font size=1 face="Arial"><</font><a href="mailto:syslog-ng@lists.balabit.hu"><font size=1 color=blue face="Arial"><u>syslog-ng@lists.balabit.hu</u></font></a><font size=1 face="Arial">></font><font size=3 face="Times New Roman">
</font><font size=1 color=#5f5f5f face="Arial"><br>
Date: </font><font size=1 face="Arial">11/08/2011
09:14 AM</font><font size=3 face="Times New Roman"> </font><font size=1 color=#5f5f5f face="Arial"><br>
Subject: </font><font size=1 face="Arial">[syslog-ng]
Quick filter question</font><font size=3 face="Times New Roman"> </font><font size=1 color=#5f5f5f face="Arial"><br>
Sent by: </font><a href="mailto:syslog-ng-bounces@lists.balabit.hu"><font size=1 color=blue face="Arial"><u>syslog-ng-bounces@lists.balabit.hu</u></font></a><font size=3 face="Times New Roman">
</font>
<div align=center>
<br>
<hr noshade></div>
<br><font size=3 face="Times New Roman"><br>
<br>
</font><font size=2 face="Calibri"><br>
Hey all!</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
Real quick…trying to filter OUT firewall hits that have say…169.254.
Will this do the trick?</font><font size=3 face="Times New Roman">
</font><font size=2 face="Calibri"><br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
filter f_firewall {</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
not program (firewall flags(ignore-case));</font><font size=3 face="Times New Roman">
</font><font size=2 face="Calibri"><br>
and not message("169\.254\.[0-9]+\.[0-9]+");</font><font size=3 face="Times New Roman">
</font><font size=2 face="Calibri"><br>
};</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
Thanks all.</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
James</font><font size=2 face="Courier New">______________________________________________________________________________<br>
Member info: </font><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"><font size=2 color=blue face="Courier New"><u>https://lists.balabit.hu/mailman/listinfo/syslog-ng</u></font></a><font size=2 face="Courier New"><br>
Documentation: </font><a href="http://www.balabit.com/support/documentation/?product=syslog-ng"><font size=2 color=blue face="Courier New"><u>http://www.balabit.com/support/documentation/?product=syslog-ng</u></font></a><font size=2 face="Courier New"><br>
FAQ: </font><a href="http://www.balabit.com/wiki/syslog-ng-faq"><font size=2 color=blue face="Courier New"><u>http://www.balabit.com/wiki/syslog-ng-faq</u></font></a><font size=2 face="Courier New"><br>
</font><tt><font size=2>______________________________________________________________________________<br>
Member info: </font></tt><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"><tt><font size=2>https://lists.balabit.hu/mailman/listinfo/syslog-ng</font></tt></a><tt><font size=2><br>
Documentation: </font></tt><a href="http://www.balabit.com/support/documentation/?product=syslog-ng"><tt><font size=2>http://www.balabit.com/support/documentation/?product=syslog-ng</font></tt></a><tt><font size=2><br>
FAQ: </font></tt><a href="http://www.balabit.com/wiki/syslog-ng-faq"><tt><font size=2>http://www.balabit.com/wiki/syslog-ng-faq</font></tt></a><tt><font size=2><br>
<br>
</font></tt>
<br>