From: Robert Fekete <frobert@balabit.hu>
To: gentoo-user@lists.gentoo.org
Subject: [gentoo-user] Re: syslog-ng filtering
Date: Wed, 17 Mar 2010 11:12:26 +0000 (UTC) [thread overview]
Message-ID: <loom.20100317T120358-65@post.gmane.org> (raw)
In-Reply-To: 201003171239.47431.alan.mckinnon@gmail.com
That's right, the value() parameter specifies which part of the message to
check. This helps to cut down the performance cost of filtering, because there
is no need to process the entire message if you are filtering on the program
name, for example.
Also, check the syslog-ng Administrator Guide
(http://www.balabit.com/support/documentation/?product=syslog-ng&type=all&language[en]=en&)
if you run into problems. And let me know if you do not find something that
should be in the guide so I can add it some time.
Regards,
Robert Fekete
maintainer of the syslog-ng documentation
next prev parent reply other threads:[~2010-03-17 11:20 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-16 23:22 [gentoo-user] syslog-ng filtering Ralph Slooten
2010-03-17 0:00 ` Roy Wright
2010-03-17 2:49 ` Ralph Slooten
2010-03-17 10:48 ` Fred Leon
2010-03-17 10:39 ` Alan McKinnon
2010-03-17 11:12 ` Robert Fekete [this message]
2010-03-17 20:16 ` Ralph Slooten
2010-03-17 20:31 ` Alan McKinnon
2010-03-19 7:56 ` [gentoo-user] " Robert Fekete
2010-03-17 20:40 ` [gentoo-user] " Keith Dart
2010-03-17 21:43 ` Ralph Slooten
2010-03-18 6:39 ` Alan McKinnon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=loom.20100317T120358-65@post.gmane.org \
--to=frobert@balabit.hu \
--cc=gentoo-user@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox