Tools

Exclude Message Rule Not Working After Upgrading from Legacy Kiwi Syslog Server (KSS) to Kiwi Syslog Server NG

After upgrading from Legacy Kiwi Syslog Server (KSS) to Kiwi Syslog Server NG (KSS NG), some users may notice that Exclude Message rules do not function as expected. This article explains why this happens and provides the steps required to ensure message exclusion works correctly.

First published date

12/3/2025 4:22 PM

Last published date

12/3/2025 4:22 PM

Overview

After upgrading from Legacy Kiwi Syslog Server (KSS) to Kiwi Syslog Server NG (KSS NG), some users may notice that Exclude Message rules do not function as expected.
This article explains why this happens and provides the steps required to ensure message exclusion works correctly.

Product section

Kiwi Syslog Server

Cause

This typically occurs due to rule processing order, filter configuration, or missing stop-processing actions in KSS NG.

Resolution

Verify the following key points:

1. Rule Processing Order in KSS NG

KSS NG processes rules sequentially from top to bottom.

If a message matches an earlier rule, it may never reach the rule containing your exclude filter.

  • Ensure the rule with the Exclude filter is placed at the correct position in the rule list.
  • If an earlier rule processes the message, add a “Stop processing message” action to that earlier rule to prevent further evaluation.

 

2. Verify the Exclude Filter Configuration

Under Message Text filtering:

  • Confirm the correct filter type is selected:
    • Simple
    • Complex
    • RegExp (Regex)
  • For exclusion use cases, the Complex filter is often recommended because it supports:
    • Include
    • Exclude
    • And
      lines for precise matching.

Make sure the Exclude field contains the exact string or pattern you want to filter out.

 

3. Add “Stop Processing Message” Action

Even after a message matches an exclude filter, KSS NG may still pass the message to subsequent rules unless you explicitly stop processing.

To fix this:

  1. Open the rule containing the exclude filter.
  2. Add the action “Stop processing message.”
  3. Save and apply the rule.

This ensures that once a message is excluded, no other rules can override the exclusion.

Relevant documentation:

How rules, filters, and actions work in KSS NG

Filter messages based on message texts in KSS NG

Add an action to stop processing the message — Legacy

Note:

If the message is already being captured by an earlier rule, adding “Stop processing message” to that earlier rule is necessary.

This prevents the message from continuing to later rules where exclusion is expected.