The flags(final) goes at the end of the log statement, not the destination.<BR> <BR>Cheers,<BR> <BR>Steve<BR>----- Message d'origine -----<BR>De: "Michael J. Bauer" <mjbauer@eecs.tufts.edu><BR>Date: Jeudi, 24 Septembre 2009, 23:00<BR>Objet: [syslog-ng] flags(final)<BR>À: syslog-ng@lists.balabit.hu<BR><BR>> I think I am misunderstanding what flags(final) is supposed to <BR>> do. I'm <BR>> running syslog-ng 2.1.4 on RHEL 5.4 (Tikanga).<BR>> <BR>> I have a fairly simple syslog-ng configuration, which I've <BR>> attached <BR>> below. I'm trying to pick off individual groups of log <BR>> entries and put <BR>> them in their own individual files. I want to ensure that <BR>> each gets <BR>> logged exactly once, so I'm using flags(final). I also <BR>> have a catch-all <BR>> at the end in case I've missed something, but the ultimate goal <BR>> is to <BR>> have that file present, but empty.<BR>> <BR>> However, with this configuration, the log entries that appear in <BR>> d_network_address_translation (/var/log/network-address-<BR>> translation) <BR>> also appear in d_default (/var/log/default) despite the presence <BR>> of <BR>> flags(final) on an earlier log() line. Should it work this <BR>> way? If so, <BR>> what can I do to get the desired behavior?<BR>> <BR>> Thanks,<BR>> MJB<BR>> <BR>> options {<BR>> sync (0);<BR>> time_reopen (10);<BR>> log_fifo_size (1000);<BR>> long_hostnames (off);<BR>> use_fqdn (no);<BR>> create_dirs (no);<BR>> keep_hostname (yes);<BR>> };<BR>> <BR>> source s_sys {<BR>> file ("/proc/kmsg" <BR>> log_prefix("kernel: "));<BR>> unix-stream ("/dev/log");<BR>> internal();<BR>> udp(ip(0.0.0.0) port(514));<BR>> };<BR>> <BR>> destination <BR>> d_network_address_translation { <BR>> file("/var/log/network-address-translation"); };<BR>> destination <BR>> d_default { file("/var/log/default"); };<BR>> <BR>> filter f_network_address_translation { host("router-service-<BR>> interface") and<BR>> priority(info) and<BR>> facility(local2) and<BR>> match("FWNAT"); };<BR>> <BR>> log { source(s_sys);<BR>> filter(f_network_address_translation);<BR>> <BR>> destination(d_network_address_translation); flags(final); };<BR>> log { source(s_sys);<BR>> destination(d_default); };<BR>> <BR>> ______________________________________________________________________________<BR>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<BR>> Documentation: <BR>> http://www.balabit.com/support/documentation/?product=syslog-ng<BR>> FAQ: http://www.campin.net/syslog-ng/faq.html<BR>>