syslog syntax
 

I want to send all syslog err messages to a remote host with the exception of user.err. To send everything I'd simply use;

*.err @remotehost

but how do I exclude user.err from this? Modifiers are for use with the severity not the facility. How do I exclude a specific facility? Do I need to list individual facilities with the exception of user to sent to the remote host? i.e.

auth.err,daemon.err, etc @remotehost

Thanks,

Would this work : *.err;!user.err @remotehost

Hi.

The solution won't work. It just stops everything going to the remotehost.

Thanks.

Maybe: *.err;user.!=err @remotehost

or: *.err;user.none @remotehost (but in this case, none of user.* log will be sent)