[syslog-ng] filtering based on text?

[Fabien Wernli]

Hi Dan,

On Sun, Feb 07, 2021 at 10:49:43PM -0700, Dan Egli wrote:
> Sorry to be gone. It's been a hell of a few days.  What you wrote looks
> promising. Where can I find more about the sudo-parser and such? That way if
> the config doesn't work I have an idea of how to tweak it.

It depends on how you installed syslog-ng, but in the RPM dists it's usually
in /usr/share/syslog-ng/include/scl that I look.