[syslog-ng 1.4.17] configuration error
Hi! I'm trying to set up syslog-ng, but it fails at startup. I'm using this configuration (excerpt): filter f_news { facility(news); }; filter f_mail { facility(mail); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_firewall { match("SuSE-FW"); }; filter f_messages { not filter(f_firewall) not filter(f_mail) not filter(f_news); }; # that's normally at the same line as f_messages When I try to run syslog-ng I get this error message: parse error at 25 Parse error reading configuration file, exiting. At line 25 there's the f_message filter. If I use filter f_message { not filter(f_firewall); }; it's working fine. But as soon as I add another "not" I get the error posted above. Can anyone tell me where's my mistake, please? :-) Arno
On Thu, Jan 09, 2003 at 07:50:07PM +0100, Arno Luppold wrote:
When I try to run syslog-ng I get this error message:
parse error at 25 Parse error reading configuration file, exiting.
At line 25 there's the f_message filter. If I use filter f_message { not filter(f_firewall); }; it's working fine. But as soon as I add another "not" I get the error posted above.
Can anyone tell me where's my mistake, please? :-)
Check out an example conf at http://www.campin.net/syslog-ng.conf or http://www.campin.net/syslog-ng/expanded-syslog-ng.conf or the documentation at http://www.balabit.hu/static/syslog-ng/reference/x97.html and you'll see that you need to use "and" in the statement. You need something like this: filter f_message { not filter(f_firewall) and not filter(f_foo); }; -- Nate Campi http://www.campin.net "A computer lets you make more mistakes faster than any invention in human history - with the possible exceptions of handguns and tequila." -Mitch Ratliffe "Never trust a computer you can't throw out a window." -Steve Wozniak
On Thursday 09 January 2003 20:10, Nate Campi wrote:
On Thu, Jan 09, 2003 at 07:50:07PM +0100, Arno Luppold wrote:
[configuration problem] Check out an example conf at http://www.campin.net/syslog-ng.conf or http://www.campin.net/syslog-ng/expanded-syslog-ng.conf or the documentation at http://www.balabit.hu/static/syslog-ng/reference/x97.html and you'll see that you need to use "and" in the statement.
Sorry for the stupid question which I could have solved for myself with the documentation... And a big thank you for the answer :-) Arno
participants (2)
-
Arno Luppold
-
Nate Campi