[syslog-ng] Converting filtering from 2.1 to 3.0?

[Worsham, Michael]

We are running syslog-ng v2.1 in a multiple client-server configuration. Due to new encryption requirements, we planning to upgrade to v3.0.8 soon and use the TLS capabilities. Upon one of our test servers, I discovered that the following filtering works just fine under syslog-ng v2.1 and blocks the messages from reaching the remote syslog-ng server:

filter M_audit   { not match("Audit daemon rotating log files"); };
filter M_snmp   { not match("snmpd"); };
filter M_repeat  { not match("last message repeated"); };
filter M_stats    { not match("Log statistics"); };
log { source(s_localhost);
       filter(M_audit);
       filter(M_snmp);
       filter(M_repeat);
       filter(M_stats);
       destination(d_general); # Remote Syslog server
};

However under syslog-ng v3.0.8, these messages are getting passed over to the remote syslog server. What do I need to do to strip these messages from getting passed through? I tried using "not message" but that doesn't seem to work.

-- Michael


________________________________
CONFIDENTIALITY NOTICE: This email and any attachments are intended solely for the use of the named recipient(s). This email may contain confidential and/or proprietary information of Scientific Research Corporation. If you are not a named recipient, you are prohibited from reviewing, copying, using, disclosing or distributing to others the information in this email and attachments. If you believe you have received this email in error, please notify the sender immediately and permanently delete the email, any attachments, and all copies thereof from any drives or storage media and destroy any printouts of the email or attachments.

EXPORT COMPLIANCE NOTICE: This email and any attachments may contain technical data subject to U.S export restrictions under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Export or transfer of this technical data and/or related information to any foreign person(s) or entity(ies), either within the U.S. or outside of the U.S., may require advance export authorization by the appropriate U.S. Government agency prior to export or transfer. In addition, technical data may not be exported or transferred to certain countries or specified designated nationals identified by U.S. embargo controls without prior export authorization. By accepting this email and any attachments, all recipients confirm that they understand and will comply with all applicable ITAR, EAR and embargo compliance requirements.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100920/8a8f5f83/attachment.htm