<pre name="code" class="html">Using negation can be useful if you would like to do some generic processing but exclude some specific events. You can use the discard action in conjunction with that. A sample would be:

*.* /var/log/allmsgs-including-informational.log

:msg, contains, "informational"  ~

*.* /var/log/allmsgs-but-informational.log

Do not overlook the tilde in line 2! In this sample, all messages are written to the file allmsgs-including-informational.log. Then, all messages containing the string “informational” are 

discarded. That means the config file lines below the “discard line” (number 2 in our sample) will not be applied to this message. Then, all remaining lines will also be written to the file 

allmsgs-but-informational.log.

使用否定是有用的,如果 你想要做一些通用的处理 但是需要排除一些特定的事件,你可以使用discard action 连接它 例子如下:

*.* /var/log/allmsgs-including-informational.log

:msg, contains, "informational"  ~

*.* /var/log/allmsgs-but-informational.log

不要忽视 波浪号 在第2行！在这个例子,所有的消息是写入到文件 allmsgs-including-informational.log. 

然后,所有的消息包含字符串  “informational” 是被丢弃的,这意味着 配置文件行 在‘discard line’下

在我们的例子中第2行不会应用这个消息,那么,所有剩下的行业会被写入到文件 allmsgs-but-informational.log.

:msg, contains, “error” ~         # 忽略包含error的日志