Agreed. What I'd like is a clause that means "log this only if not yet handled". That way, we get it both ways -- if you don't specify anything, you get the current behavior, in which it would go to both logs. Plus, with the "not-yet-logged" clause, I could catch everything where I want it, and then do the "not-yet-logged" clause just for the remaining facility(daemon), for example.
- John...
The DEFAULT filter exists for exactly this purpose. It may be buggy since I haven't touched that feature since 1.3.xx (when I implemented it), but the syntax looks like this: log { source(src); filter(DEFAULT); destination(dst); }; DEFAULT filters all not-yet-handled messages. I'll check out the other not expression bugs as well. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt