[syslog-ng]can't figure out how to convert syslog.conf entry to syslog-ng

[Balazs Scheidler]

On Mon, 2004-12-27 at 09:02 -0500, Philip J. Hollenback wrote:
> I have the following syslog.conf entry on my linux server:
> 
> *.info;mail.none;mail.err;authpriv.none;auth.none;auth.warning;cron.none;cron.warning;local0.none                /var/log/messages
> 
> The syslog2ng script converts it to this:
> 
> destination d_mesg { file("/var/log/messages"); };
> 
> filter f_1 { level(info..emerg); };
> filter f_2 { not facility(mail); };
> filter f_3 { facility(mail) and level(err..emerg); };
> filter f_4 { not facility(authpriv); };
> filter f_5 { not facility(auth); };
> filter f_6 { facility(auth) and level(warning..emerg); };
> filter f_7 { not facility(cron); };
> filter f_8 { facility(cron) and level(warning..emerg); };
> filter f_9 { not facility(local0); };
> 
> log {
>   source(local);
>   filter(f_1); filter(f_2); filter(f_3); filter(f_4);
>   filter(f_5); filter(f_6); filter(f_7); filter(f_8);
>   filter(f_9);
>   destination(d_mesg);
> };
> 
> 
> Problem: this doesn't work; the above syslog-ng.conf entry doesn't
> send any messages to /var/log/messages.  I know syslog-ng is working
> because other entries in the config file do catch messages as they
> should.
> 
> I've narrowed it down to something with the compound filter
> statements.  If I remove f_3, f_6, and f_8, the entry starts working.

Note that syslog-ng ANDs the filter expressions listed in your log
statement. E.g. while syslogd ORs them syslog-ng ANDs them.

in f_3 you require facility(mail) while in f_2 you explicitly disallow
it via not.

Maybe you should construct a single filter expression ORing the
conditions in the original syslog.conf entry.