John,
This makes messages for ftpd go to ftpdlog and for named go to namedlog. The problem is that they still also go to the daemonlog since they are daemon.info messages. What I want is a way to tell syslog-ng that I do NOT want it to also send those to the daemonlog file. It seems that there should be a directive to say "send these to this log ONLY if they haven't already been handled."
I did try doing this for the daemon filter:
filter f_daemon { facility(daemon) and not filter(f_ftpd) and not filter(f_named); };
...but this does not work. I still get the ftpd and named messages
try filter f_daemon { facility(daemon) and not program(name);}; where "name" is whatever program you're trying to filter out. I think the match keyword will take care of this as well. Regards, Ger.