I have searched the whole archive but I have not found any solution to my problem. ----------------- destination messages { file("/var/log/messages.log"); }; filter f_messages { level(info..warn) and not macht("snort") and not facility(auth, news, mail); }; log { source(s_tcp); filter(f_messages); destination(messages); }; ---------------------- I want logs that contain word "snort" not to be directed to /var/log/messages but it seems that filter not match("snort") does not work. Thank you in advance for your help marbo
Mariusz Bogumil on Wed, Mar 21, 2001 at 12:45:23PM +0100:
filter f_messages { level(info..warn) and not macht("snort") and not ^^^^^ That should be "match" ... I get good results with filters like this.
regards, -- Gregor Binder <gregor.binder@sysfive.com> http://sysfive.com/ sysfive.com GmbH UNIX. Networking. Security. Applications. PGP id: 0x20C6DA55 fp: 18AB 2DD0 F8FA D710 1EDC A97A B128 01C0 20C6 DA55
On Wed, Mar 21, 2001 at 12:55:06PM +0100, Gregor Binder wrote:
Mariusz Bogumil on Wed, Mar 21, 2001 at 12:45:23PM +0100:
filter f_messages { level(info..warn) and not macht("snort") and not ^^^^^ That should be "match" ... I get good results with filters like this.
and match() searches in the message itself, if you want to match the program name use program() instead. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
participants (3)
-
Balazs Scheidler
-
Gregor Binder
-
Mariusz Bogumil