Re: [syslog-ng] How to build a filter where one message from one host not logged

----- Original message -----

Hi !

I want to filter with syslog-ng that a message from a special host with a special message was not filtered and everything else goes to the logfile

filter f_cisco_switches_knownerrors1         {                 host ("hostxy")                 and match("ENVIRONMENT-3-RPS_FAILED");         };

The Log-Message : Mar 29 12:29:19 hostxy err 20979: Mar 29 12:29:18: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected

this is probably caused by the fact that the cisco mnemonics go to the $PROGRAM value and match() in versions past 3.0 only match against the $MESSAGE part. Try matching using program()