# syslog-ng match() filter (solved)

## orange_juice

Hallo,

After upgrading to app-admin/syslog-ng-3.0.4, I keep receiving the message:

```
WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration;

Error in configuration, unresolved source reference; source='kernsrc'

 * Failed to start syslog-ng                                              
```

One of the lines that causes the problem, is for example the following:

```
filter f_shorewall { facility(kern) and

       match ("Shorewall") or

       match ("IN=") or

       match ("OUT=") or

       match ("PASS") or

       match ("NEW TCP w/o SYN:") or

       match ("SYN FLOOD:"); };

```

How could I transform it in order to do the same job in an acceptable way?

Kind regards,

orange_juiceLast edited by orange_juice on Thu Nov 12, 2009 8:14 pm; edited 1 time in total

----------

## ToeiRei

The syntax changed. match -> message

```
filter f_shorewall { facility(kern) and 

       message("Shorewall") or 

       message("IN=") or 

       message("OUT=") or 

       message("PASS") or 

       message("NEW TCP w/o SYN:") or 

       message("SYN FLOOD:"); }; 
```

But this doesn't prevent syslog-ng to start.

Look at your source named 'kernsrc' as the message says: Error in configuration, unresolved source reference; source='kernsrc'

----------

## orange_juice

Thank you very much, the mistake has been spotted!

Kind regards,

orange_juice

----------

## gohmdoree

not a mistake, but a change. =)

----------

## orange_juice

 :Smile: 

----------

