[syslog-ng] WARNING: the match() filter without the use of the value() ...

[Alan McKinnon]

On Friday 25 June 2010 10:18:38 ml ml wrote:
> Hello List,
> 
> i am getting this error:
> WARNING: the match() filter without the use of the value() option is
> deprecated and hinders performance, please update your configuration;
> Restarting syslog-ng: Stopping syslog-ng: OK.
> Starting syslog-ng: WARNING: the match() filter without the use of the
> value() option is deprecated and hinders performance, please update
> your configuration;

[snip] 

> ### 3.) FILTERS
> filter f_ldap           { match("slapd");               };

The message tell you what to do, it's right there in the admin guide :-)

pg 213 of the 3.0 admin guide:

The syntax has changed from earlier versions. match() now wants to know which 
part of the log to perform the match on. Your matches seem to use the program 
name, so use:

(match("slapd" value=("PROGRAM"))

to search the entire message for a match, use

(match("slapd" VALUE="MSG"))

or (better)

message("slpad")

Note that the macro name (MSG, PROGRAM, etc) does not have a leading $ - you 
are giving a macro name to use, not dereferencing it.


-- 
Alan McKinnon
Systems Engineer^W Technician
Infrastructure Services
Internet Solutions

+27 11 575 7585

Please note: This email and its content are subject to the disclaimer as displayed at the following link http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. Should you not have Web access, send a mail to disclaimers at is.co.za and a copy will be emailed to you.