How to build a filter where one message from one host not logged
Hi ! I want to filter with syslog-ng that a message from a special host with a special message was not filtered and everything else goes to the logfile filter f_cisco_switches_knownerrors1 { host ("hostxy") and match("ENVIRONMENT-3-RPS_FAILED"); }; The Log-Message : Mar 29 12:29:19 hostxy err 20979: Mar 29 12:29:18: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected Thanks, Niels
----- Original message -----
Hi !
I want to filter with syslog-ng that a message from a special host with a special message was not filtered and everything else goes to the logfile
filter f_cisco_switches_knownerrors1 { host ("hostxy") and match("ENVIRONMENT-3-RPS_FAILED"); };
The Log-Message : Mar 29 12:29:19 hostxy err 20979: Mar 29 12:29:18: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected
this is probably caused by the fact that the cisco mnemonics go to the $PROGRAM value and match() in versions past 3.0 only match against the $MESSAGE part. Try matching using program()
participants (2)
-
Balazs Scheidler
-
Niels Graupe