<div dir="ltr"><div>T/F </div><div><br></div><div>On a log statement with 3 or more channels would a <b>copy</b> of each message matching the filter would be sent to that destination. </div><div><br></div><div><div dir="ltr" style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><div style="font-size:12.8px">log {<br>    source(s_net_tcp); <br>   <span> </span><span class="gmail-il">channel</span><span> </span>{ filter(f_allpci); destination (d_splunk_PCI); };<br>   <span> </span><span class="gmail-il">channel</span><span> </span>{ filter(f_allpci); destination (d_sumo_PCI); };<br></div><div style="font-size:12.8px">   <span> </span><span class="gmail-il">channel</span><span> </span>{ filter(f_swpci); destination (d_secureworks); };<br>}; </div></div><div class="gmail-yj6qo gmail-ajU" style="outline:none;padding:10px 0px;width:22px;margin:2px 0px 0px;color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><br class="gmail-Apple-interchange-newline"></div><br></div><div> <br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 22, 2018 at 2:04 PM, Scot <span dir="ltr"><<a href="mailto:scotrn@gmail.com" target="_blank">scotrn@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-size:12.8px">That was a bad example on my part. I will need unique filters for each destination.  </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">log {<br>    source(s_net_tcp); <br>    channel { filter(f_allpci); destination (d_splunk_PCI); };<br>    channel { filter(f_allpci); destination (d_sumo_PCI); };<br></div><div style="font-size:12.8px">    channel { filter(f_swpci); destination (d_secureworks); };<br>}; </div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Jan 21, 2018 at 9:41 PM, Scot <span dir="ltr"><<a href="mailto:scotrn@gmail.com" target="_blank">scotrn@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Evan, <div>Thats very helpful, is there somewhere these performance considerations are outlined? </div><div>Only think I see related is 2.2.1 in the manual. </div><div><br></div><div>I'll try tying combining the destinations under on log statement in the morning. </div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="m_2142926784378859052h5">On Sat, Jan 20, 2018 at 11:02 AM, Evan Rempel <span dir="ltr"><<a href="mailto:erempel@uvic.ca" target="_blank">erempel@uvic.ca</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_2142926784378859052h5">
  
    
  
  <div text="#000000" bgcolor="#FFFFFF">
    <div class="m_2142926784378859052m_8945445071974058476m_3686659491037748065moz-cite-prefix">I would favour a config like<br>
      <br>
      <div>log {<br>
            source(s_net_tcp); <br>
            channel { filter(f_pci); destination (d_splunk_PCI); };<br>
            channel { filter(f_pci); destination (d_sumo_PCI); };<br>
      </div>
      <div>    channel { filter(f_pci); destination (d_secureworks); };<br>
        };<br>
      </div>
      <div><br>
        Although I think your config should work I don't like the idea
        of "re-sourcing" the stream.<br>
        <br>
        Now that I look closer at what you have done you are using the
        same filter, so it could be<br>
        <br>
        <div><span>log {<br>
              source(s_net_tcp); <br>
              filter(f_pci);<br>
              destination (d_splunk_PCI);<br></span>
              destination (d_sumo_PCI);<br>
        </div>
        <div>    destination (d_secureworks);<br>
          };<br>
        </div>
        <div><br>
          <br>
          which takes the source, filters it and sends to all three
          destinations.<span class="m_2142926784378859052m_8945445071974058476HOEnZb"><font color="#888888"><br>
          <br>
          Evan.<br>
        </font></span></div>
      </div><div><div class="m_2142926784378859052m_8945445071974058476h5">
      <br>
      <br>
      On 01/20/2018 07:28 AM, Scot wrote:<br>
    </div></div></div><div><div class="m_2142926784378859052m_8945445071974058476h5">
    <blockquote type="cite">
      
      <div dir="ltr">Thanks Jim, 
        <div>I have 4 configs
          <div>sources.conf</div>
          <div>destinations.conf </div>
          <div>filters.conf</div>
          <div>log.conf </div>
          <div><br>
          </div>
          <div>Can't post them without revealing sensitive network info
            but wanted to make sure I wasn't assuming something should
            just work. </div>
          <div>I'll post more after I dig into it but seems to favor the
            first matching log destination when I switch the order and
            reload with syslog-ng-ctl. </div>
          <div><br>
          </div>
          <div>log { source(s_net_tcp); filter(f_pci); destination
            (d_splunk_PCI);};<br>
          </div>
          <div>log { source(s_net_tcp); filter(f_pci); destination
            (d_sumo_PCI);};<br>
          </div>
          <div>log { source(s_net_tcp); filter(f_pci); destination
            (d_secureworks);};<br>
          </div>
          <div><br>
          </div>
          <div><br>
          </div>
        </div>
      </div>
      <div class="gmail_extra"><br>
        <div class="gmail_quote">On Fri, Jan 19, 2018 at 6:41 PM,
          james.r.hendrick <span dir="ltr"><<a href="mailto:james.r.hendrick@gmail.com" target="_blank">james.r.hendrick@gmail.com</a>></span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div>
              <div>It should work. Would you share the config?</div>
              <div>Jim</div>
              <div><br>
              </div>
              <div><br>
              </div>
              <div><br>
              </div>
              <div id="m_2142926784378859052m_8945445071974058476m_3686659491037748065m_5017559045485440611composer_signature">
                <div style="font-size:85%;color:#575757" dir="auto">Sent
                  from my Verizon, Samsung Galaxy smartphone</div>
              </div>
              <div>
                <div class="m_2142926784378859052m_8945445071974058476m_3686659491037748065h5">
                  <div><br>
                  </div>
                  <div style="font-size:100%;color:#000000">
                    <div>-------- Original message --------</div>
                    <div>From: Scot <<a href="mailto:scotrn@gmail.com" target="_blank">scotrn@gmail.com</a>>
                    </div>
                    <div>Date: 1/19/18 4:23 PM (GMT-05:00) </div>
                    <div>To: Syslog-ng users' and developers' mailing
                      list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>>
                    </div>
                    <div>Subject: [syslog-ng] One source multiple
                      destinations ? </div>
                    <div><br>
                    </div>
                  </div>
                  <div dir="ltr">I'm having a problem where I am trying
                    to take  input source(s) and write them out to
                    multiple destinations.  
                    <div><br>
                    </div>
                    <div>Before I go barking up the wrong tree I just
                      wanted to make sure I wasn't missing something. </div>
                    <div><br>
                    </div>
                    <div>We should be able to take a source and send it
                      to file, elastic-search and SPLUNK and sumologic
                      all at the same time right ? </div>
                    <div><br>
                    </div>
                    <div>Troubleshooting an odd behavior where only one
                      network destination will work but then I switch
                      the order the other starts working.</div>
                    <div><br>
                    </div>
                    <div>I know it's vague but has anyone seen this
                      behavior? </div>
                    <div><br>
                    </div>
                    <div>Thanks </div>
                    <div>Scot </div>
                  </div>
                </div>
              </div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
  </div></div></div>

<br></div></div><span>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></span></blockquote></div><br></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>