Filters perform log routing inside syslog-ng. You can write a boolean expression using internal functions, which has to evaluate to true for the message to pass.
Filters have also a uniquely identifying name, so you can refer to filters in your log statements. Syntax for the filter statement:
filter <identifier> { expression; }; |
Example 2-2. A filter statement finding the messages containing the word deny coming from the host blurp
filter f_blurp_deny { host("blurp") and match("deny"); }; |
Table 2-3. Available filter functions in syslog-ng
Function | Description |
---|---|
facility() | Selects messages based on their facility code |
level() or priority() | Selects messages based on their priority |
program() | Tries to match a regular expression to the program name field of log messages |
host() | Tries to match a regular expression to the hostname field of log messages |
match() | Tries to match a regular expression to the message itself. |
filter() | Call another filter rule and evaluate its value |
For a complete description on the above functions, see the Reference chapter.
There's a special filter identifier "DEFAULT" which allows you to catch not-yet-handled messages. For example, consider the following configuration:
options { keep_hostname(yes); }; source src { unix-stream("proba2"); internal(); }; destination ftpd { file("ftplog"); }; destination named { file("namedlog"); }; destination daemon { file("daemonlog"); }; filter f_ftpd { match("ftp"); }; filter f_named { match("named"); }; filter f_daemon { facility(daemon); }; log { source(src); filter(f_ftpd); destination(ftpd); }; log { source(src); filter(f_named); destination(named); }; log { source(src); filter(f_daemon); filter(DEFAULT); destination(daemon); }; |