Host filter not working?
I think I'm going crazy... Can someone tell me why this is not filtering these hosts? filter f_not_unitylab { ( not host ("localhost") or not host ("vnt-cm") or not host ("ecats-cu") ); }; # Tell syslog-ng to log to our new destination log { source(s_all); filter(f_not_unitylab); destination(d_logzilla); }; When I start syslog-ng, I'm still getting events logged to my db for these hosts. What am I missing? -- ______________________________________________________________ Clayton Dukes ______________________________________________________________
Tuesday 29 of September 2009 20:54:08 Clayton Dukes napisał(a):
I think I'm going crazy... Can someone tell me why this is not filtering these hosts?
filter f_not_unitylab { ( not host ("localhost") or not host ("vnt-cm") or not host ("ecats-cu") ); }; [...] When I start syslog-ng, I'm still getting events logged to my db for these hosts. What am I missing?
Boolean logic. :) You need ANDs, not ORs. -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D
Yep. You're saying "if it's not a dog or not a cat or not a cow then do this" so it would have to be some sort of frankenstein dog/cat/cow monster to pass the test. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jakub Jankowski Sent: 29 September 2009 19:58 To: cdukes@cdukes.com; Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Host filter not working? Tuesday 29 of September 2009 20:54:08 Clayton Dukes napisał(a):
I think I'm going crazy... Can someone tell me why this is not filtering these hosts?
filter f_not_unitylab { ( not host ("localhost") or not host ("vnt-cm") or not host ("ecats-cu") ); }; [...] When I start syslog-ng, I'm still getting events logged to my db for these hosts. What am I missing?
Boolean logic. :) You need ANDs, not ORs. -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
O great googley moogely...why didn't I see that? Thanks for the great analogy :-) 2009/9/30 Fegan, Joe <Joe.Fegan@hp.com>:
Yep. You're saying "if it's not a dog or not a cat or not a cow then do this" so it would have to be some sort of frankenstein dog/cat/cow monster to pass the test.
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jakub Jankowski Sent: 29 September 2009 19:58 To: cdukes@cdukes.com; Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Host filter not working?
Tuesday 29 of September 2009 20:54:08 Clayton Dukes napisał(a):
I think I'm going crazy... Can someone tell me why this is not filtering these hosts?
filter f_not_unitylab { ( not host ("localhost") or not host ("vnt-cm") or not host ("ecats-cu") ); }; [...] When I start syslog-ng, I'm still getting events logged to my db for these hosts. What am I missing?
Boolean logic. :)
You need ANDs, not ORs.
-- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
-- ______________________________________________________________ Clayton Dukes ______________________________________________________________
participants (3)
-
Clayton Dukes
-
Fegan, Joe
-
Jakub Jankowski