Chapter 3 - Additional Features
User Guide
261
Examples:
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_debug { not facility(auth, authpriv, news, mail); };
2) To filter by level:
filter f_level { level(<level name>);};
Examples:
filter f_messages { level(info .. warn)};
filter f_emergency { level(emerg); };
filter f_alert { level(alert); };
3) To filter by matching one string in the received message:
filter f_match { match(‘string’); };
Example to filter by matching the string “named”:
filter f_named { match(‘named’); };
4) To filter ALARM messages (note that the following three examples should be one line):
filter f_alarm { facility(local[0+<conf.DB_facility>]) and
level(info) and match('ALARM') and match('<your string>'); } ;
Example to filter ALARM message with the string “kernel panic”:
filter f_kpanic { facility(local[0+<conf.DB_facility>]) and
level(info) and match('ALARM') and match('kernel panic'); };
Example to filter ALARM message with the string “root login”:
filter f_root { facility(local[0+<conf.DB_facility>]) and
level(info) and match('ALARM') and match('root login'); };
