This is exactly what I was looking for. Thanks Balazs! 2008/8/29 Balazs Scheidler <bazsi@balabit.hu>
On Fri, 2008-08-29 at 10:00 +0200, G R wrote:
I've think I've found a solution. If the attribute program is empty, then the attributes $MSG and $MSGONLY should be equals. The filter function match() try to match the $MSG or $MSGONLY ?
Trying this doesn't work, but I think this can be the beginning of the solution :
match($MSGONLY) or, match($MSG) depending on wich $MSG or $MSGONLY the filter function applies.
Isn't this what you are looking for?
program("^$")
-- Bazsi
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html