<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
I knew it would be simple. Thank you very much.<br>
On 1/17/2010 4:03 PM, Siem Korteweg wrote:
<blockquote
cite="mid:61F7C813E194BE4B978C9F1A16165CBE06B737@EX01.QNH.local"
type="cite">
<pre wrap="">Jerry,
from the admin manual:
Message filtering, parsing, and rewriting is performed in the order that the
operations appear in the log statement.
So, change the order in your log-statements to:
log { source(NET); filter(A); destination(A); };
Also change your second filter statement to filter for host B.
regards,
Siem Korteweg
-----Oorspronkelijk bericht-----
Van: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a> namens Jerry Bell
Verzonden: zo 17-1-2010 15:26
Aan: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>
Onderwerp: [syslog-ng] Odd problem after upgrading from 2.1 to 3
This config worked in syslog-ng 2.1
source NET {udp(port(514)); tcp(port(5140) keep-alive(yes));};
destination A { file("/var/log/A"); };
destination B { file("/var/log/B"); };
filter A { host ("A");};
filter A { host ("A");};
log { source(NET); destination(A); filter(A); };
log { source(NET); destination(B); filter(B); };
worked as expected that is log messages coming from host A went to
/var/log/A file
and log messages coming from host B went to /var/log/B.
The two hostnames are resolved locally in /etc/hosts
After upgrading to 3.0.x all the messages duplicated in both files so
that messages coming from A are written in /var/log/A AND /var/log/B and
vice-versa. Any idea why it does not work in 3?
Thank you,
Jerry
_____________________________________________________________________________
_
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation:
<a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
</body>
</html>