[syslog-ng] Re: syslog-ng digest, Vol 1 #132 - 2 msgs

[Balazs Scheidler]

> > > Parse error reading configuration file, exiting.
> > 
> > Version 1.3.11 had a major problem in the parser, which I have fixed in the
> > just released 1.3.12. Please test this release too.
> 
> I think, there is still a problem in the parser, while this line
> doesn't work:
> 
> filter f_all    { host("install1") not match("sshd"); };
> 
> When the "not" is exchanged with by "and" or "or", all works fine.

This should be:

filter f_all { host("install1") and not match("sshd"); };

and note that both host() and match() expect a regular expression, so if you
want to match only sshd and not "ossdq", you should use:

match("^sshd$")

^ means beginning of line, $ means end of line.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
     url: http://www.balabit.hu/pgpkey.txt