[syslog-ng] Filtre empty program

[G R]

This is exactly what I was looking for.

Thanks Balazs!


2008/8/29 Balazs Scheidler <bazsi at balabit.hu>

> On Fri, 2008-08-29 at 10:00 +0200, G R wrote:
> > I've think I've found a solution.
> > If the attribute program is empty, then the attributes $MSG and
> > $MSGONLY should be equals.
> > The filter function match() try to match the $MSG or $MSGONLY ?
> >
> > Trying this doesn't work, but I think this can be the beginning of the
> > solution :
> >
> > match($MSGONLY)
> > or,
> > match($MSG)
> > depending on wich $MSG or $MSGONLY the filter function applies.
>
> Isn't this what you are looking for?
>
> program("^$")
>
>
> --
> Bazsi
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20080829/753c71d9/attachment.htm