On Mon, Jul 30, 2007 at 12:49:20PM +0100, Geller, Sandor (IT) wrote:
I have this config file:
<snip>
When an event arrives at the system by facility local0 or local1, this one is registered in the file never. Can be some bug of syslog-ng or failure in config?
If I understand you correctly then the problem is that you're using two filters which exclude each other however using more filters they are logically AND-ed. If you want to catch messages from local0 and local1 use a filter like this:
filter f_local01 { facility(local0) or facility(local1); };
What a perfect FAQ entry. I know I've documented this before but I'm pretty sure it was internal documentation at a past job. Now it's up for all to see: http://www.campin.net/syslog-ng/faq.html#filters Oh, and I see that you answered afterwards Evan. Yours was good too. :) -- Nate You can lead an idiot to knowledge but you cannot make him think. You can, however, rectally insert the information, printed on stone tablets, using a sharpened poker.