[syslog-ng] Ignoring previously handled/filtered messages

[ger]

John,

>
>
> This makes messages for ftpd go to ftpdlog and for named go to namedlog.  The
> problem is that they still also go to the daemonlog since they are daemon.info
> messages.  What I want is a way to tell syslog-ng that I do NOT want it to
> also send those to the daemonlog file.  It seems that there should be a
> directive to say "send these to this log ONLY if they haven't already been
> handled."
>
> I did try doing this for the daemon filter:
>
> filter f_daemon { facility(daemon)
>                 and not filter(f_ftpd)
>                 and not filter(f_named); };
>
> ...but this does not work.  I still get the ftpd and named messages

try
  filter f_daemon { facility(daemon) and not program(name);};

where "name" is whatever program you're trying to filter out.

I think the match keyword will take care of this as well.

Regards, Ger.