Re: syslog-ng digest, Vol 1 #132 - 2 msgs
On Wed, 5 Jan 2000 syslog-ng-admin@venus.terrasoft.hu wrote:
When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..."
Today's Topics:
1. Filter operator "not" does not work (Andreas Zymny) 2. Re: Filter operator "not" does not work (Balazs Scheidler)
--__--__--
Message: 1 Date: Tue, 4 Jan 2000 17:56:59 +0000 (GMT) From: Andreas Zymny <anzy@du.gtn.com> To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Filter operator "not" does not work Reply-To: syslog-ng@lists.balabit.hu
Hi,
I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" operator for the filters doesn't work in the 1.3.11 version.
bash-2.03# /usr/sbin/syslogd parse error at 13 Parse error reading configuration file, exiting.
Andreas Zymny (Technik) [a.zymny@dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de
--__--__--
Message: 2 Date: Tue, 4 Jan 2000 18:10:52 +0100 From: Balazs Scheidler <bazsi@balabit.hu> To: syslog-ng@venus.terrasoft.hu Subject: Re: [syslog-ng] Filter operator "not" does not work Reply-To: syslog-ng@lists.balabit.hu
On Tue, Jan 04, 2000 at 05:56:59PM +0000, Andreas Zymny wrote:
Hi,
I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" operator for the filters doesn't work in the 1.3.11 version.
bash-2.03# /usr/sbin/syslogd parse error at 13 Parse error reading configuration file, exiting.
Version 1.3.11 had a major problem in the parser, which I have fixed in the just released 1.3.12. Please test this release too.
I think, there is still a problem in the parser, while this line doesn't work: filter f_all { host("install1") not match("sshd"); }; When the "not" is exchanged with by "and" or "or", all works fine. Andreas Zymny (Technik) [a.zymny@dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de
Parse error reading configuration file, exiting.
Version 1.3.11 had a major problem in the parser, which I have fixed in the just released 1.3.12. Please test this release too.
I think, there is still a problem in the parser, while this line doesn't work:
filter f_all { host("install1") not match("sshd"); };
When the "not" is exchanged with by "and" or "or", all works fine.
This should be: filter f_all { host("install1") and not match("sshd"); }; and note that both host() and match() expect a regular expression, so if you want to match only sshd and not "ossdq", you should use: match("^sshd$") ^ means beginning of line, $ means end of line. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
participants (2)
-
Andreas Zymny
-
Balazs Scheidler