Thank you for the answer. <br><br>Seems to be what I am looking for, but I am not able to make it works :<br><br>log { source(stunnel); filter(f_apache); destination(remoteclient_apache); flags(final); };<br><br>Any idea ? <br>
<br>I am running syslog-ng :3.1.3 on debian squeeze.<br><br>Regards,<br><br><br><div class="gmail_quote">On 11 April 2012 12:12, Gergely Nagy <span dir="ltr"><<a href="mailto:algernon@balabit.hu" target="_blank">algernon@balabit.hu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>Hugo Deprez <<a href="mailto:hugo.deprez@gmail.com" target="_blank">hugo.deprez@gmail.com</a>> writes:<br>
<br>
> The issue is that my apache2 logs match other filter, so I am logging<br>
> messages 3 times :<br>
</div>[...]<br>
<div>> I would like to know how do you deal with this kind of situation ?<br>
<br>
</div>Put your apache2 logpath first, and use flags(final):<br>
<br>
log {<br>
source(s_whatever);<br>
filter(f_apache);<br>
destination(d_whatever);<br>
flags(final);<br>
};<br>
<br>
The flags(final) option will tell syslog-ng to stop processing the<br>
message there and then: it won't be sent forward to the rest of the<br>
logpaths.<br>
<br>
Hope this helps!<br>
<span><font color="#888888"><br>
--<br>
|8]<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</font></span></blockquote></div><br>