Yep. You're saying "if it's not a dog or not a cat or not a cow then do this" so it would have to be some sort of frankenstein dog/cat/cow monster to pass the test. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jakub Jankowski Sent: 29 September 2009 19:58 To: cdukes@cdukes.com; Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Host filter not working? Tuesday 29 of September 2009 20:54:08 Clayton Dukes napisał(a):
I think I'm going crazy... Can someone tell me why this is not filtering these hosts?
filter f_not_unitylab { ( not host ("localhost") or not host ("vnt-cm") or not host ("ecats-cu") ); }; [...] When I start syslog-ng, I'm still getting events logged to my db for these hosts. What am I missing?
Boolean logic. :) You need ANDs, not ORs. -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html