On Fri, 2008-08-29 at 10:00 +0200, G R wrote:
> I've think I've found a solution.
> If the attribute program is empty, then the attributes $MSG and
> $MSGONLY should be equals.
> The filter function match() try to match the $MSG or $MSGONLY ?
>
> Trying this doesn't work, but I think this can be the beginning of the
> solution :
>
> match($MSGONLY)
> or,
> match($MSG)
> depending on wich $MSG or $MSGONLY the filter function applies.

Isn't this what you are looking for?

program("^$")


--
Bazsi

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html