A filter like this should work, be aware this is case _SENSITIVE_ filter f_vfs {match("VFS: Disk change detected");}; Kéven Belanger Analyste en solutions de sécurité Logicon Inc. - Division Sécurité 819.825.8049 x7717 800.567.6399 x7717 -----Original Message----- From: bhartin@straus-frank.com [mailto:bhartin@straus-frank.com] Sent: Wednesday, August 21, 2002 15:58 PM To: syslog-ng@lists.balabit.hu Subject: RE: [syslog-ng]Supressing messages... On Wed, 21 Aug 2002, Keven Belanger wrote:

If there is no way to exclude it, try to make a new destination to /dev/null ?

The problem is that I haven't found a way for a filter to catch it. The kernel version uses a printk for KERN_DEBUG. I've tried a filter against facility for debug, kern.debug, and *.debug--all of which show up as unknown facilities. I tried 'match("Disk change detected")' to no avail either. I may have to bite the bullet and move to a newer version, but.... -- Bradley Hartin - bhartin@straus-frank.com Communications and Network Administrator Straus-Frank Company _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html