<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>yup, you can find the patch reference in bugzilla, but it also got integrated to mainline, github.com/balabit/syslog-ng-3.4 that is.
<br>
<br>the fix is quite recent, so you can cherry-pick it yourself, but Algernon had nightly builds for a number of platforms on madhouse.org
<br>
<br>----- Original message -----
<br>> There was a patch with refarss to include statements tgat fixes this.
<br>> Not a release yet but will be 3.4.2
<br>>
<br>>
<br>> ----
<br>> Evan Rempel,  250-721-7691
<br>> Senior Systems Administrator
<br>> Data Centre Services, University of Victoria
<br>>
<br>>
<br>>
<br>>
<br>> -------- Original message --------
<br>> From: "Fanselow, William" <<a href="mailto:William.Fanselow@Level3.com">William.Fanselow@Level3.com</a>>
<br>> Date:
<br>> To: <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>
<br>> Subject: [syslog-ng] flags(final) in version 3.4
<br>>
<br>>
<br>> According to this report, the flags(final) does not work in 3.4 as one
<br>> got used to in prior versions.
<br>> <a href="https://lists.balabit.hu/pipermail/syslog-ng/2013-February/020039.html">https://lists.balabit.hu/pipermail/syslog-ng/2013-February/020039.html</a>
<br>>
<br>> In version 3.3 I used flags(final) in each of my log{ } statements so
<br>> that a message was not unnecessarily processed by anything beyond a
<br>> matching filter.  My last entry in the config used flags(fallback) so
<br>> that any message not previously sent to a destination was caught by this
<br>> final stanza.
<br>>
<br>> With version 3.4, the same syntax does not work, and all messages appear
<br>> to be passing through every filter and getting duplicated in the first
<br>> match and  my final log destination.
<br>>
<br>> Surely, there must be another way to handle this sort of thing.  Not
<br>> only is it useful for processing efficiency, but it is also a useful way
<br>> to identify "unmatched" filters in the config.
<br>>
<br>> Any suggestions for replicating the 3.3 behavior would be appreciated.
<br>>
<br>> Thanks
<br>> Bill Fanselow
<br>> ______________________________________________________________________________
<br>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> Documentation:
<br>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:
<br>> <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>>
<br><br></p>
</body>
</html>