[rsyslog-notify] Forum Thread: Re: filter invalid syslogtag - (Mode 'reply')

[noreply at adiscon.com]

User: awinberg 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26750#p26750

Message: 
----------
[quote="rgerhards":uwqchdbq]sorry, I overlooked that you tried filtering
for procid == "" (lots of things and conversations go on in parallel). That
should work. I'll see if I can add a quick testbench test to ensure it
does, but procid should NOT be empty in the first place. It needs to be "-"
if empty. That's a bug fixed a couple of month ago. Nevertheless, a
comparison for emptyness should obviously work.[/quote:uwqchdbq]

Hm, I think I may have spoke too soon. I thought the logging stopped
completely if I applied the filter on the logserver, but when I test it now
it actually works - as in it does not discard all my logs (I was too
impatient and didnt wait long enough. Since this is a production
environment...). It does however not discard the messages I want to discard
either (the vmkernel and the lxserv350 messages, for instance). So there
seems to be some issue with filters on empty properties, maybe?