# the match() filter without the use of the value() option

## disperato

I'm getting this cryptic message on startup:

```

WARNING: the match() filter without the use of the value() option is

deprecated and hinders performance, please update your configuration;
```

obviously, googling with the string above didn't spit out the most wanted answer: how should I update my configuration?

The only thing I worked out by reading the three (only) threads that match with this string, is that the issue is related to a syslog-ng upgrade. I have indeed upgraded from 2.1.4 to 3.0.4.

Could someone, please, shed a light on what should I do?

----------

## disperato

How strange...

though I don't have on this machine any of the following items: avc, audit, grsec, pax (and it's not an hardened profile, of course) I have these lines in /etc/syslog-ng/syslog-ng.conf

```
destination avc { file("/var/log/avc.log"); };

destination audit { file("/var/log/audit.log"); };

destination pax { file("/var/log/pax.log"); };

destination grsec { file("/var/log/grsec.log"); };

filter f_avc { match(".*avc: .*"); };

filter f_audit { match("^audit.*") and not match(".*avc: .*"); };

filter f_pax { match("^PAX:.*"); };

filter f_grsec { match("^grsec:.*"); };

log { source(kernsrc); filter(f_pax); destination(pax); };

log { source(kernsrc); filter(f_grsec); destination(grsec); };

log { source(kernsrc); filter(f_audit); destination(audit); };

log { source(kernsrc); filter(f_avc); destination(avc); };

```

once commented the message has gone.

----------

## cmp

I got the same msg's but I use a hardened profile so If I comment them out will I have disadvantage??

----------

## agent_jdh

Just noticed this on my hardened server since syslog-ng update - anyone know how to get rid of the messages?

----------

## mack1

I had the same issue yesterday, and i replaced 'match()' with 'message(), and now it works fine  :Very Happy:  .

https://lists.balabit.hu/pipermail/syslog-ng/2009-September/013372.html

http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch08s04.html

https://bugs.gentoo.org/show_bug.cgi?id=291259

If you want only to search in the body message, the function "message()"  should be appropriate  :Wink:  .  

Cheers

----------

## agent_jdh

Nice one, was going to search bugzilla.  Replacing match() with message() works here.

----------

