<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Is it possible to configure multiple sources, one with flags(no-parse) and one without?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">e.g.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">source <b>s_syslog-ports</b> {<o:p></o:p></p>
<p class="MsoNormal"> udp(port(514));<o:p></o:p></p>
<p class="MsoNormal"> tcp(port(1514) max-connections(100));<o:p></o:p></p>
<p class="MsoNormal"> tcp(port(514) max-connections(100));<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">source <b>s_syslog_np-ports </b>{<o:p></o:p></p>
<p class="MsoNormal"> udp(port(514) flags(no-parse));<o:p></o:p></p>
<p class="MsoNormal"> tcp(port(1514) max-connections(100) flags(no-parse));<o:p></o:p></p>
<p class="MsoNormal"> tcp(port(514) max-connections(100) flags(no-parse));<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">filter f_Cisco-router { in-list("/etc/syslog-ng/filter/Cisco-router.txt", value("SOURCEIP")); };<o:p></o:p></p>
<p class="MsoNormal">destination d_Cisco-router {file("/var/log/IT/network/router/cisco/${SOURCEIP}/${SOURCEIP}-${YEAR}${MONTH}${DAY}.log" template(t_message-only));};<o:p></o:p></p>
<p class="MsoNormal">log {source(<b>s_syslog-ports</b>); filter(f_Cisco-router); destination(d_Cisco-router);};<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">filter f_Cisco-switch { in-list("/etc/syslog-ng/filter/Cisco-switch.txt", value("SOURCEIP")); };<o:p></o:p></p>
<p class="MsoNormal">destination d_Cisco-switch {file("/var/log/IT/network/switch/cisco/${SOURCEIP}/${SOURCEIP}-${YEAR}${MONTH}${DAY}.log" template(t_message-only));};<o:p></o:p></p>
<p class="MsoNormal">log {source(<b>s_syslog_np-ports</b>); filter(f_Cisco-switch); destination(d_Cisco-switch);};<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Whenever I do this, I get an error message when restarting the service.<o:p></o:p></p>
<p class="MsoNormal">“Job for syslog-ng.service failed because the control process exited with error code. See "systemctl status syslog-ng.service" and "journalctl -xe" for details.”
<o:p></o:p></p>
<p class="MsoNormal">“Cannot add dependency job for unit microcode.service, ignoring: Unit is not loaded properly: Invalid argument.”<o:p></o:p></p>
<p class="MsoNormal"><span style="color: rgb(64, 64, 64); font-size: 10pt; font-family: Calibri, sans-serif;"> </span></p>
</div>
</blockquote></body></html>