<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Here is an example of what I am trying to do, these hostnames are not real; the real ones have no common pattern.</p>
<p><br>
</p>
<p><span>filter f_xyz { host("*.abca.*") or host(".*abcb.*") or host(".*abcc.*") or host(".*abcd.*") or host(".*abce.*") or host(".*abcf.*") or host(".*abcg.*") or host(".*abch.*"); };</span></p>
<p><br>
</p>
<p>The filter above is for any host containing a hostname with what is contained within the .* and *.; i.e. hostabca01 will be matched by
<span>host("*.abca.*") </span></p>
<p><br>
</p>
<p>When I have this filter in my config, syslog fails to restart.</p>
<p><br>
</p>
<p>Eyes hurt, obvious mistake?</p>
</div>
</body>
</html>