[syslog-ng] log action or discard ?

[Jan Schaumann]

Hello,

I have a syslog server that receives syslog messages and will forward a
selection of them to a central host via TLS.  It will log all other
messages to a local file.  The current configuration looks something
like this:

destination forward {
	syslog(<options here>);
};

destination all {
	file("/var/log/all");
};

filter forward {
	match("mumble");
};

log {
	all-my-sources
	filter(forward);
	destination(forward);
	flags(final);
};

log {
	all-my-sources
	destination(all);
};


Now if my remote server to which I'm forwarding messages to goes down or
stops accepting connections for any reason, _all_ my logging will come
to a grinding halt.  That is, nothing gets appended to /var/log/all.

What I want is for my forwarding to be a "try this or discard" kind of
scenario.  That is, if I can't forward the messages, just drop them, but
continue to log all other messages unphased.

Is that possible?  If so, how?

Thanks in advance,
-Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 186 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20091118/292ab4f0/attachment.pgp