Hello,<br><br>thank you ! that was my issue. <br><br>I do have issue to find a proper filter for apache2. vhost mixed up as filtering on the FQDN is not enough.<br>Some apache2 logs doesn't contain the FQDN. <br><br>Any idea ?<br>
Regards,<br><br>Hugo<br><br><div class="gmail_quote">On 12 April 2012 10:51, Gergely Nagy <span dir="ltr"><<a href="mailto:algernon@balabit.hu">algernon@balabit.hu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">Hugo Deprez <<a href="mailto:hugo.deprez@gmail.com">hugo.deprez@gmail.com</a>> writes:<br>
<br>
> Yes I do, should I specify those one first ?<br>
<br>
</div>The apache one should come first, otherwise your logs will go through<br>
the ones before it (if any of the filters match, of course), resulting<br>
in duplicate logs.<br>
<br>
Put the apache one first, and flags(final) will not let matching logs<br>
through to the others.<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
|8]<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br>