1 |
I think you need a semi-colon inside and after the right curly brace ('}') |
2 |
|
3 |
You right braces are parentheses and not right curly braces too (maybe a |
4 |
cut and paste issue?) |
5 |
|
6 |
FWIW, the following is what I use to separate my mail logs out and it works: |
7 |
|
8 |
destination messages { file("/var/log/messages"); }; |
9 |
destination maillog { file("/var/log/maillog"); }; |
10 |
|
11 |
filter f_mail { facility(mail); }; |
12 |
filter f_messages { not facility(mail); }; |
13 |
|
14 |
log { source(src); filter(f_mail); destination(maillog); }; |
15 |
log { source(src); filter(f_messages); destination(messages); }; |
16 |
|
17 |
On 12/15/2020 10:44 PM, Dan Egli wrote: |
18 |
> Help me understand this, please? I have ISC dhcpd configured to log |
19 |
> to syslog.local7 (since I don't see an option to force it into it's |
20 |
> own log file). So I went into my syslog-ng file and created two |
21 |
> filters, just like on the example page of syslog-ng.com: |
22 |
> |
23 |
> filter dhcpmsgs { facility(23) ); |
24 |
> filter non_dhcp { NOT filter(dhcpmsgs) ) |
25 |
> |
26 |
> I quoted almost directly from the example page on syslog-ng.com, but I |
27 |
> keep getting this error when I reload syslog-ng's config: |
28 |
> Error parsing filter expression, filter plugin NOT not found OR you |
29 |
> may not used double quotes in your filter expression in |
30 |
> /etc/syslog-ng/syslog-ng.conf:25:18-25:21: |
31 |
> |
32 |
> What did I do wrong? Here's the lines I modified from the syslog-ng page: |
33 |
> filter demo_filter { host("example") and match("deny" |
34 |
> value("MESSAGE")) }; |
35 |
> filter inverted_demo_filter { NOT filter(demo_filter) } |
36 |
> |
37 |
> You can see the page at: |
38 |
> https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-guide/53 |
39 |
> |
40 |
> |