syslog expression questions

[egarnel]

I have a few questions about how syslog handles expressions.

Lets' say for example, I want to alert on the word 'config', but not on 'DOT1X-3-PSK_CONFIG_ERR'
Could put a removal rule higher up on the list that removes 'DOT1X-3-PSK_CONFIG_ERR' and then a rule lower that alerts on 'config'?
Or else do the rules support boolean operators?

Also, if the 1st condition works, would it be possible <feature request> to add in removal rule order sorting?

Thanks,

Eric

[egarnel]

Follow up question to my previous question....

I noticed that removal rules could also be sql expressions. Sorry to be a bit simplistic, but could someone post an example of an sql expresssion in a context in line with cacti sylog?

Thanks,

Eric