Yes, you set up a logical filter. filter f_kern.debug { facility(kern) and level(debug); }; filter f_kern { facility(kern) and not level(debug); }; Hope it helps. Regards, Drew

-----Original Message----- From: Ann Markley [SMTP:amarkley@aventail.com] Sent: Tuesday, December 12, 2000 12:52 AM To: 'syslog-ng@lists.balabit.hu' Subject: [syslog-ng]syslog-ng question on filter facility/priority

I would like to filter out kern.debug info from messages when we HUP syslog-ng. I have set up a filter: "filter f_kern.debug { not facility(kern); };" which filters out all kern messages from going to /var/adm/messages. I set up another filter "filter f_kern { facility(kern); };" that logs to destination file /var/log/kern.log" so I can pick up any kernel messages. Is there a way to set up a filter for facilty(kern) that will filter out the debug info but still log the higher level messages to /var/adm/messages? We are running on Solaris 2.6.

Thanks!

Ann Markley Systems Engineer amarkley@aventail.com

Aventail Corporation www.aventail.com

Ann Markley Systems Engineer amarkley@aventail.com

Aventail Corporation www.aventail.com

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng