[syslog-ng] Host filter not working?

[Fegan, Joe]

Yep. You're saying "if it's not a dog or not a cat or not a cow then do this" so it would have to be some sort of frankenstein dog/cat/cow monster to pass the test.

-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Jakub Jankowski
Sent: 29 September 2009 19:58
To: cdukes at cdukes.com; Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Host filter not working?

Tuesday 29 of September 2009 20:54:08 Clayton Dukes napisał(a):
> I think I'm going crazy...
> Can someone tell me why this is not filtering these hosts?
>
> filter f_not_unitylab { (
>     not host ("localhost")
>     or not host ("vnt-cm")
>     or not host ("ecats-cu")
>     );
> };
[...]
> When I start syslog-ng, I'm still getting events logged to my db for
> these hosts. What am I missing?

Boolean logic. :)

You need ANDs, not ORs.

-- 
Jakub Jankowski|shasta at toxcorp.com|http://toxcorp.com/
GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html