SYSLOG-NG - Having trouble with a destination
- by Samuurai
Hi,
I'm trying to set up a seperate log file for all windows messages. I've set up a match for MSWinEventLog, but it's completely ignoring my configuration
Here's my config, which is straight after the src object
filter f_windows { match("MSWinEventLog"); };
destination winFIFO { file("/var/log/splunk/syslog-ng/winFIFO"); };
log { source(src); filter(f_windows); destination(winFIFO); flags(final); };
It all ends up in this one instead:
filter f_messages { not facility(news, mail) and not filter(f_iptables); };
destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };
Can anyone see what i'm doing wrong?
