Hi,

I'm trying to set up a seperate log file for all windows messages. I've set up a match for MSWinEventLog, but it's completely ignoring my configuration

Here's my config, which is straight after the src object

filter f_windows    { match("MSWinEventLog"); };
destination winFIFO { file("/var/log/splunk/syslog-ng/winFIFO"); };
log { source(src); filter(f_windows); destination(winFIFO); flags(final); };

It all ends up in this one instead:

filter f_messages   { not facility(news, mail) and not filter(f_iptables); };
destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };

Can anyone see what i'm doing wrong?