Dan, On Wednesday, 2021-04-07 12:05:10 -0600, you wrote:
> I had posted the whole file. But I can do it again easy enough.
> ...
> filter samba { program("samba"); };
> filter ssh_messages { facility("AUTH") and level("INFO"); };
> filter syslog { not filter("ssh_messages") and not filter("samba"); };
Omit the double quotes in this last line. You're needing the NAMES of
the filters here.
Sincerely,
Rainer
