[syslog-ng] Ignoring previously handled/filtered messages

ger ger@tinet.ie
Wed, 24 May 2000 14:39:50 -0400


> This makes messages for ftpd go to ftpdlog and for named go to namedlog.  The
> problem is that they still also go to the daemonlog since they are daemon.info
> messages.  What I want is a way to tell syslog-ng that I do NOT want it to
> also send those to the daemonlog file.  It seems that there should be a
> directive to say "send these to this log ONLY if they haven't already been
> handled."
> I did try doing this for the daemon filter:
> filter f_daemon { facility(daemon)
>                 and not filter(f_ftpd)
>                 and not filter(f_named); };
> ...but this does not work.  I still get the ftpd and named messages

  filter f_daemon { facility(daemon) and not program(name);};

where "name" is whatever program you're trying to filter out.

I think the match keyword will take care of this as well.

Regards, Ger.