Setting a level(debug..emerg) is unuseful, cause you want all level. If you want to get all message from local7 and that match %ETH-5 or %CLEAR-5 you have to write it like this : filter f_local7 { facility(local7) and ( match("%ETHC-5") or match("%CLEAR-5") ) ; } ; Hope it will help Amodiovalerio [Hypo] Verde ---------- Initial Header ----------- From : syslog-ng-admin@lists.balabit.hu To : syslog-ng@lists.balabit.hu Cc : Date : Fri, 26 Mar 2004 11:02:14 -0600 Subject : [syslog-ng]regex question

When regexing in syslog-ng, does this stament below do:

get all local7 ( all levels ) and _/ALSO/_ match %ETHC-5 / %CLEAR-5 ? Its not just matching those is it ? Im kinda confused on this syntax.

filter f_local7 { facility(local7) and level(debug..emerg) and match("%ETHC-5") and match("%CLEAR-5"); };

I just want to make shure that is what this is doing... .

Thanks all.

~!>D _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html