[gentoo-user] Re: syslog-ng filtering

[Robert Fekete]

Alan McKinnon alan.mckinnon at gmail.com writes:
 
 I see Robert responded here earlier. Perhaps he'll see this post and re-look 
 at that section in a new light with a view to making a patch
 
Yes, there are some sections in the admin guide that sorely need a cleanup. I
hope to get to it before summer.

If you see other problems or missing stuff, feedback is most welcome at
documentat...@balabit.com or frob...@balabit.hu.

Regards, 

Robert

[gentoo-user] Re: syslog-ng filtering

[Robert Fekete]

That's right, the value() parameter specifies which part of the message to
check. This helps to cut down the performance cost of filtering, because there
is no need to process the entire message if you are filtering on the program
name, for example. 

Also, check the syslog-ng Administrator Guide
(http://www.balabit.com/support/documentation/?product=syslog-ngtype=alllanguage[en]=en;)
if you run into problems. And let me know if you do not find something that
should be in the guide so I can add it some time.

Regards, 

Robert Fekete
maintainer of the syslog-ng documentation