Description of problem:
I am trying to port a syslog-ng configuration to rsyslog.
I believe, however, that there are bugs in the filter expression evaluator
in rsyslog that makes it impossible to port the configuration successfully.
I opened a discussion thread on this in rsyslog forum here:
http://kb.monitorware.com/expression-based-filter-troubles-with-3-21-9-t8924.html


Version-Release number of selected component (if applicable):
3.21.9

How reproducible:
Install rsyslog.conf including a section like this:

$template CronFormat,"%timereported% %HOSTNAME% %syslogtag% [cronrule %syslogseverity-text% %syslogseverity%]%msg:::sp-if-no-1st-sp%%msg%\n"

if ($syslogfacility-text == 'cron') and ($syslogseverity <= 4) \
  then /var/log/bug;CronFormat

Run rsyslog and note that you get entries like this:

bash-3.2$ cat /var/log/bug
Feb 17 10:50:01 ti82 CROND[31805]: [cronrule info 6] (root) CMD (/usr/lib/sa/sa1 -d 1 1)

This entry should not be there, since the severity (6) is not <= 4.


Steps to Reproduce:
1. Install /etc/rsyslog.conf with a filter expression similar to above
2. Run rsyslog
3. Observe that it does not filter properly.
  
Actual results:
Incorrect entries in /var/log/bug

Expected results:
The /var/log/bug file should be empty in the normal case (for info messages
about jobs that cron is running).

Additional info: