On Wednesday 17 March 2010 01:22:59 Ralph Slooten wrote:
> Hi all,
>
> Has anyone here worked out how to filter out syslog messages using
> syslog-ng v3? The old syntax doesn't work (well complains bitterly about
> performance and says to use regex), and no matter what I try I cannot get
> the new syntax to work :-/ I have a syslog-ng server which logs to MySQL
> for multiple clients in a network, however the database just keeps growing
> with irrelevant data I'd prefer to just quietly ignore on the server side.
>
> I'm trying to filter out (exclude) messages such as:
> (root) CMD (/root/bin/vmware-checker)
> and
> (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
>
> ==============
> filter myfilter {
> not match("regex" value("\/usr\/sbin\/run-crons"))
> and not match("regex" value("vmware-checker"));
> }
Hah! this caught me out too.
The value of "value" cannot be anything arbitrary - syslog-ng has no clue what
you mean. The value is a field name, either a pre-defined one, or something
you defined using a parser. The docs are ambiguous on this, it's not clear
that the supplied values are abstracts. You are truing to search for the
string "regex" in a field called /usr/bin/vmware-checker.
Which obviously will not work.
I think you want:
match("\/usr\/sbin\/run-crons" value "MESSAGE")
Note that it is MESSAGE. You want the field name, not it's dereferenced value.
> log {
> source(src);
> source(remote);
> filter(myfilter);
> destination(d_mysql);
> };
> ===============
>
> However they just keep coming through the filter (ie: not matching the "not
> match" filter). I've tried escaping the slashes, not escaping them ... even
> partial words, but I obviously am missing something somewhere.
>
> Anyone have any ideas?
>
> Thanks in advance,
> Ralph
--
alan dot mckinnon at gmail dot com
