<div class="gmail_quote">On Fri, Apr 2, 2010 at 1:25 AM, SZALAY Attila <span dir="ltr"><<a href="mailto:sasa@balabit.hu">sasa@balabit.hu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi All!<br>
<div class="im"><br>
On Thu, 2010-04-01 at 11:37 -0600, Martin Holste wrote:<br>
> Ok, I think I see what you're saying: the tag only exists on the local<br>
> box and does not get forwarded in the message. You were saying you<br>
> have to overwrite the original program with some other value so that<br>
> the tag is permanent and will survive multiple relays. Sorry for the<br>
> confusion.<br>
<br>
</div>Try to think about the tags as a sticky note on a package. When I want<br>
to create a lot of uniform white bag I put a sticky note into it, so I<br>
can make a difference between them. But after I write the correct<br>
adresses I take off the notes from it. In the example the tag is not<br>
surviving the relays, He put the tag _value_ into an another field. Just<br>
like if I put some information into the destination address to my mail.<br>
<br>
But I think that the idea of the persistant tags is great. And in the<br>
new syslog protocol there is space for it. I will create a feature<br>
request for it. :)<br>
<div class="im"><br></div></blockquote><div> </div><div>I agree. When tagging was first announced I was disappointed that they would not survive relays. Program_override is a way to 'tag' relayed messages, but it seems like a work-around (just like, say, using templates to add a custom string before $MSG to filter for at your receiving host). In a large setup, matching by host or other means is not manageable (especially if you want your configs to be multi-site compatible), so I think persistent tags would be a useful feature when sending from syslog-ng to syslog-ng.</div>
</div><br>-- <br>Lance Laursen<br>Demonware Systems Engineer<br>