Re: Multiple patterns for matching within socklog?

Gerrit Pape <pape <at> smarden.org> writes:

> [ ... ]
>
> Hmm, how about?:
> 
>  -*
>  +mail.*:*:*:*imap*
>  +mail.*:*:*:*pop*
> 
> and
> 
>  -*
>  +mail.*
>  -mail.*:*:*:*imap*
>  -mail.*:*:*:*pop*

Now, I have a related question:

If I'm using these filters and I then want to send the same info to
stderr, will the non-stderr filters be in effect at the time I issue
the 'e' and 'E' filters, or do I have to repeat the same filtering
patterns for the stderr rules?  In other words, if after all this
"imap" and "pop" filtering is done, I want to send lines with the
string "error" in them to stderr, which is correct, option "A" or
option "B"?

option A:
  -*
  +mail.*
  -mail.*:*:*:*imap*
  -mail.*:*:*:*pop*
  e*:*:*:*error*

option B:
  -*
  +mail.*
  -mail.*:*:*:*imap*
  -mail.*:*:*:*pop*
  E*
  email.*
  Email.*:*:*:*imap*
  Email.*:*:*:*pop*
  e*:*:*:*error*

Thanks.