On Thu, 2011-10-13 at 13:43 -0700, Jay wrote:

Hello

If the filter specified in syslog-ng.conf contains the ( character or ) character, then is it correct to prefix them with \\.

For example, if I need to filter a syslog containing the string (abcd)

then in syslog-ng.conf, I would need to specify the filter as \\(abcd\ \)

within double quotes, yes. within single quotes, you'd only need a single backslash. For example: match("\\(abcd\\)"); or match('\(abcd\)');

Could someone confirm, if this is the correct way of specifying the filter, please ?

If not, please let me know the correct way of specifying the filter.

HTH. -- Bazsi