[syslog-ng]Filtering by time or date

Wesolowski Michal syslog-ng@lists.balabit.hu
Mon, 29 Mar 2004 12:05:13 +0200


Hi

I'm testing syslog-ng for centralized log server on Solaris 8. It acts very
well and I was even able to create real-time notification mechanizm based on
syslog-ng and some scripts (without any additional log analizer). The
problem I've lately met is that some computers sending their messages to
central system frequently perform additional maintanence tasks during nights
or off days. For example they scan disks and other i/o devices and in effect
produce many warnings. That messages almost always countain information
which are suspicous within work hours and they cannot be filtered
permanently.
My question is: Is it possible or planed for future releases to include time
conditions in filter functions?. The "match" statement doesn't seem to check
date or time and using program as destination is quite hard due to it
"destination" not filter role in log paths. In my opinion very interesting
option would be including external program as filter (ie. returning filter
decision as std output or exit code).

Greetings

Michal Wesolowski