kstone is correct. Put your most specific rule at the top of the list and have it filter to do the action desired and stop processing the messages. If you do not need that syslog entry handled in another way after that rule is applied then add the Stop Processing action to it. I generally suggest that the first rule(s) in an environment be built to eliminate all noisy/unwanted syslog data with a stop processing action so that the syslog server doesn't waste cycles on that data. Then it goes from most specific to least specific where a stop processing needs to be added.
↧