<p dir="ltr">Also you can set mark-mode() to none which filters out all mark messages.</p>
<div class="gmail_quote">On Aug 6, 2015 4:52 PM, "Fabien Wernli" <<a href="mailto:wernli@in2p3.fr">wernli@in2p3.fr</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
On Thu, Aug 06, 2015 at 04:43:16PM +0200, Cosmin Neagu wrote:<br>
> source s_src {<br>
> system();<br>
> internal();<br>
> };<br>
<br>
reading the docs on "mark-mode()" you can see that it's set to "internal"<br>
for "program()" destinations. Also: "When internal mark mode is selected,<br>
internal source should be placed in the log path as this mode does not<br>
generate mark by itself at the destination".<br>
<br>
You *did* place "internal()" into the log path through "s_src" which<br>
explains why the mark messages *are* routed through the logpath containing<br>
your email program.<br>
<br>
Now you have to find out why the filter isn't working.<br>
<br>
What I'd also do if I were you is look up the native "smtp()" destination<br>
which could simplify your config.<br>
<br>
Cheers<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>