[syslog-ng] Quick filter question

[Lay, James]

Hey all!

 

Real quick...trying to filter OUT firewall hits that have say...169.254.
Will this do the trick?

 

filter f_firewall {

        not program (firewall flags(ignore-case));

        and not message("169\.254\.[0-9]+\.[0-9]+");

};

 

Thanks all.

 

James

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20111108/fa974a59/attachment-0001.htm