Hi Evan, use the final flag in this log path. For example: log { source(src); filter(f_kern); filter(f_debug); filter(not_ntpd); destination(messages); flags(final); }; For more information see our documentation: http://www.balabit.hu/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch08s03.htm... Evan Baer wrote:
Hello,
I'm trying to exclude ntpd update messages from /var/log/messages.
I have created a filter like so: filter not_ntpd { not program("ntpd*"); };
And implemented it in my log lines:
log { source(src); filter(not_ntpd); destination(messages); }; log { source(src); filter(f_notice); filter(f_not_authpriv); filter(not_ntpd); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); filter(not_ntpd); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); };
Yet the lines for ntpd still seem to pass through to the logfile.
Feb 23 09:20:48 magpie-shn1e1324 ntpd[37397]: synchronized to 10.2.253.22, stratum 1 Feb 23 09:20:49 magpie-shn1f1318 ntpd[729]: kernel time sync status change 2001
Any thoughts? -- Evan ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
-- pzolee