<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>There was a patch with refarss to include statements tgat fixes this. Not a release yet but will be 3.4.2</div>
<div><br>
</div>
<div><br>
</div>
----<br>
Evan Rempel, 250-721-7691
<div>Senior Systems Administrator
<div>Data Centre Services, University of Victoria<br>
<br>
</div>
</div>
<br>
<br>
<br>
-------- Original message --------<br>
From: "Fanselow, William" <William.Fanselow@Level3.com> <br>
Date: <br>
To: syslog-ng@lists.balabit.hu <br>
Subject: [syslog-ng] flags(final) in version 3.4 <br>
<br>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">According to this report, the flags(final) does not work in 3.4 as one got used to in prior versions.<br>
<a href="https://lists.balabit.hu/pipermail/syslog-ng/2013-February/020039.html">https://lists.balabit.hu/pipermail/syslog-ng/2013-February/020039.html</a><br>
<br>
In version 3.3 I used flags(final) in each of my log{ } statements so that a message was not unnecessarily processed by anything beyond a matching filter. My last entry in the config used flags(fallback) so that any message not previously sent to a destination
was caught by this final stanza.<br>
<br>
With version 3.4, the same syntax does not work, and all messages appear to be passing through every filter and getting duplicated in the first match and my final log destination.<br>
<br>
Surely, there must be another way to handle this sort of thing. Not only is it useful for processing efficiency, but it is also a useful way to identify "unmatched" filters in the config.<br>
<br>
Any suggestions for replicating the 3.3 behavior would be appreciated.<br>
<br>
Thanks<br>
Bill Fanselow<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div>
</span></font>
</body>
</html>