I am suspicious that the program() filter is not working as expected on these logs. Can you try to create a separate log file for just ntpd logs like this? filter ntpd {program("ntpd"); }; destination d_ntpd { file("/var/log/ntpdtest"); }; log { source(src); filter(ntpd); destination(d_ntpd); }; That would tell us whether the program filter is actually interpreting the program field properly for these logs. Jerry On 2/23/2010 10:58 AM, Evan Baer wrote:
Same result, the ntpd lines still make it through.
On Tue, Feb 23, 2010 at 10:09 AM, Fegan, Joe<Joe.Fegan@hp.com> wrote:
Try it without the *
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Baer Sent: 23 February 2010 14:57 To: Zoltán Pallagi Cc: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] problem with filtering in syslog-ng
The ntpd lines are still falling through. Should I include the final() syntax on all my log lines?
filter not_ntpd { not program("ntpd*"); };
log { source(src); filter(f_notice); filter(f_not_authpriv); filter(not_ntpd); destination(messages); flags(final); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); };
Here is an example of what we still see in the logs:
Feb 23 09:55:50 hobbit-shn1f0503 ntpd[729]: Listening on interface #2 lo0, 127.0.0.1#123 Enabled Feb 23 09:55:50 hobbit-shn1f0503 ntpd[729]: Listening on routing socket on fd #23 for interface updates