<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>----- Original message -----
<br>> Hi !
<br>>
<br>> I want to filter with syslog-ng that a message from a special host with
<br>> a special message was not filtered and everything else goes to the
<br>> logfile
<br>>
<br>> filter f_cisco_switches_knownerrors1
<br>>  {
<br>>  host ("hostxy")
<br>>  and match("ENVIRONMENT-3-RPS_FAILED");
<br>>  };
<br>>
<br>> The Log-Message :
<br>> Mar 29 12:29:19 hostxy err 20979: Mar 29 12:29:18:
<br>> %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected
<br>
<br>this is probably caused by the fact that the cisco mnemonics go to the $PROGRAM value and match() in versions past 3.0 only match against the $MESSAGE part.
<br>
<br>Try matching using program()</p>
</body>
</html>