title: log4j - StringMatchFilter still logging unmatched logs
body: <p>Hope anyone could help me with this issue, so basically I am using log4j-1.2.17 and sorry, I can't update it to log4j2. 
  As the title suggests, I need to do the following, </p>
  
  <ol>
  <li>I am trying to create an <strong>audit.log</strong> file which only logs information that has a certain string element (e.g., USER ACTION) and doesn't log anything else. </li>
  <li>I have another <strong>operations.log</strong> that will log everything but not the one with String <strong>USER ACTION</strong></li>
  </ol>
  
  <p>My <strong>log4j.properties</strong> file looks something like this, </p>
  
  <pre><code>log4j.logger.com.ssl=INFO, Output 
  log4j.logger.com.ssl=INFO, Audit
  
  log4j.appender.Output=org.apache.log4j.DailyRollingFileAppender
  log4j.appender.Output.DatePattern='.'yyyy-MM-dd
  log4j.appender.Output.File=/var/log/operational/operations.log
  log4j.appender.Output.layout=org.apache.log4j.PatternLayout
  log4j.appender.Output.layout.ConversionPattern=%d{yyyy-MM-dd HH:mm:ss} %-5p [%t] %m (%c)%n 
  log4j.appender.Output.Threshold=TRACE
  log4j.appender.Output.filter.1=org.apache.log4j.varia.StringMatchFilter
  log4j.appender.Output.filter.1.StringToMatch=USER ACTION
  log4j.appender.Output.filter.1.AcceptOnMatch=false
  log4j.appender.Output.filter=org.apache.log4j.varia.DenyAllFilter
  
  log4j.appender.Audit=org.apache.log4j.DailyRollingFileAppender
  log4j.appender.Audit.DatePattern='.'yyyy-MM-dd
  log4j.appender.Audit.File=/var/log/operational/audit.log
  log4j.appender.Audit.Threshold=TRACE
  log4j.appender.Audit.layout=org.apache.log4j.PatternLayout
  log4j.appender.Audit.layout.ConversionPattern=%d{yyyy-MM-dd HH:mm:ss} %-5p [%t] %m (%c)%n
  log4j.appender.Audit.filter.1=org.apache.log4j.varia.StringMatchFilter
  log4j.appender.Audit.filter.1.StringToMatch=USER ACTION
  log4j.appender.Audit.filter.1.AcceptOnMatch=true
  log4j.appender.Audit.filter=org.apache.log4j.varia.DenyAllFilter
  </code></pre>
  
  <p>Inside the <strong>Java Code</strong>, I have something like this, </p>
  
  <pre><code>private static final String AUDIT_LOG_PREFIX = "USER ACTION";
  logger.info("Just testing if this appears before the one below it");
  logger.info("[" + AUDIT_LOG_PREFIX + "] - User Details Updated by User : "+ r.getUserName());
  </code></pre>
  
  <p>The log output I get is as follows, </p>
  
  <p><strong>operational.log</strong></p>
  
  <pre><code>2018-11-22 10:55:31 INFO  [http-nio-8080-exec-179] Just testing if this appears before the one below it (com.ssl.operational.action.EditDetailsActionBean)
  </code></pre>
  
  <p><strong>audit.log</strong></p>
  
  <pre><code>2018-11-22 10:58:51 INFO  [http-nio-8080-exec-192] Just testing if this appears before the one below it (com.ssl.operational.action.EditDetailsActionBean)
  2018-11-22 10:58:51 INFO  [http-nio-8080-exec-192] [USER ACTION] - User Details Updated by User : adminuser
  </code></pre>
  
  <p>So really hoping that <strong>audit.log</strong> doesn't display the first log entry and just displays the one with USER ACTION string.</p>
  
  <p>Any help or advice will be greatly appreciated, Thank you</p>