<span style=" font-size:10pt;font-family:sans-serif">Hi!</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">Good Lord, I think
I just found the answer to my question in the Documentation :-/ :-)</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">"</span><span style=" font-size:10pt;font-family:Verdana">This
default behavior can be changed using the </span><span style=" font-size:10pt;font-family:Consolas">flags()
</span><span style=" font-size:10pt;font-family:Verdana">parameter. Flags
apply to individual log paths, they are not global options. </span><span style=" font-size:10pt;font-family:sans-serif">"</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">Therefore I think
the final breaks out of the log-processing of the actual log-directive,
but others "matching" will processed</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">Argh... think
I have to cat some of my config-files together...</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">Sorry for "spamming"
:-)</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">cheers<br>
Matthias</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">P.S. If I am wrong,
please correct me (hope dies last ;->)</span>
<br>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">------------------------------------------------------------------------------------<br>
METZLER <br>
Informationstechnologie<br>
<br>
Matthias Gruber <br>
IT-Infrastruktur & -Betrieb<br>
<br>
B. Metzler seel. Sohn & Co.<br>
Kommanditgesellschaft auf Aktien<br>
Untermainanlage 1<br>
60329 Frankfurt am Main<br>
Telefon (0 69) 21 04 - 43 30<br>
Telefax (0 69) 21 04 - 40 40<br>
MGruber@metzler.com<br>
</span><a href=www.metzler.com><span style=" font-size:10pt;font-family:sans-serif">www.metzler.com</span></a>
<br>
<br>
<br>
<br><span style=" font-size:9pt;color:#5f5f5f;font-family:sans-serif">Von:
</span><span style=" font-size:9pt;font-family:sans-serif">Matthias
Gruber/METZLER</span>
<br><span style=" font-size:9pt;color:#5f5f5f;font-family:sans-serif">An:
</span><span style=" font-size:9pt;font-family:sans-serif">"Syslog-ng
users' and developers' mailing list" <syslog-ng@lists.balabit.hu></span>
<br><span style=" font-size:9pt;color:#5f5f5f;font-family:sans-serif">Datum:
</span><span style=" font-size:9pt;font-family:sans-serif">19.11.2019
08:54</span>
<br><span style=" font-size:9pt;color:#5f5f5f;font-family:sans-serif">Betreff:
</span><span style=" font-size:9pt;font-family:sans-serif">Abort
message processing - multiple includes</span>
<br>
<hr noshade>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">Hi!</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">Perhaps I misunderstood
it, or got a bit crossed up, because I dig into syslog-ng-Configs since
weeks, but I am unsure about the "flags(final)" statement</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">I have several
includes with several log-statements and several sources</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">e.g. (no
runnable syntax, only for demonstration-purpose)</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">0001-A.conf</span>
<br><span style=" font-size:10pt;font-family:sans-serif">log {</span>
<br><span style=" font-size:10pt;font-family:sans-serif">
source(s_tcp_A);</span>
<br><span style=" font-size:10pt;font-family:sans-serif">
filter(f_filter_A);</span>
<br><span style=" font-size:10pt;font-family:sans-serif">
destination(d_somewhere_A);</span>
<br><span style=" font-size:10pt;font-family:sans-serif">
flags(final);</span>
<br><span style=" font-size:10pt;font-family:sans-serif">};</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">0002-B.conf</span>
<br><span style=" font-size:10pt;font-family:sans-serif">log {</span>
<br><span style=" font-size:10pt;font-family:sans-serif">
source(s_tcp_A);</span>
<br><span style=" font-size:10pt;font-family:sans-serif">
destination(d_somewhere_BBB);</span>
<br><span style=" font-size:10pt;font-family:sans-serif">
flags(final);</span>
<br><span style=" font-size:10pt;font-family:sans-serif">};</span>
<br>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">As I understand
it, first of all, its included in "alphabetical order", so in
my case first 0001-A.conf, then 0002-B.conf and so on.... </span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">But now my "Problem"
and question</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">(Yes I would normally
do a "if"-Construct to solve that, problem above, but I used
that example to understand the flags(final),)</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">If I have a message
received by s_tcp_A, filter f_filter_A hits, the rule sends it to d_somewhere_A
and do a "Escape" cause of flags(final), does the message still
got processes by the include of 0002-B.conf??</span>
<br><span style=" font-size:10pt;font-family:sans-serif">Does the flags(final)
is only relevant for one "log-rule", or does it ends the whole
processing?</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">To be honest,
I habe several includes, and a "last" one, which is imported
last, with a "hit"-all, in my childish thought, if the flags(final)
stopps processing of the message compleetly this hit-all only gets "the
junk" where nothing else hists. Why do I do that, and not write it
in one file with a large if-elif-else-construct, I do that for the readability
since this file would be extremly large.</span>
<br>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">I am thankfull
for any help</span>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">cheers</span>
<br><span style=" font-size:10pt;font-family:sans-serif">Matthias</span>
<br>
<br>
<br>
<br><span style=" font-size:10pt;font-family:sans-serif">------------------------------------------------------------------------------------<br>
METZLER <br>
Informationstechnologie<br>
<br>
Matthias Gruber <br>
IT-Infrastruktur & -Betrieb<br>
<br>
B. Metzler seel. Sohn & Co.<br>
Kommanditgesellschaft auf Aktien<br>
Untermainanlage 1<br>
60329 Frankfurt am Main<br>
Telefon (0 69) 21 04 - 43 30<br>
Telefax (0 69) 21 04 - 40 40<br>
MGruber@metzler.com<br>
</span><a href=www.metzler.com><span style=" font-size:10pt;font-family:sans-serif">www.metzler.com</span></a>
<br>
<br>
<br><font size="2" face="Arial"><font size="2" face="Arial"> </font></font><br>
<br>
<font size="2" face="Arial">Persönlich haftende Gesellschafter: Harald Illy, Michael Klaus, Friedrich von Metzler, Emmerich Müller, Gerhard Wiesheu<br>
Vorsitzender des Aufsichtsrats: Dr. Christoph Schücking<br>
Sitz der Gesellschaft: Frankfurt am Main, </font><font size="2" face="Arial">Handelsregister-Nr.</font><font size="2" face="Arial"> HRB 27 515</font><br>
<br>
<font size="2" face="Arial"><font size="2" face="Arial">Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfänger sein, so bitten wir Sie höflich, dies unverzüglich dem Absender mitzuteilen und die Nachricht zu löschen. Es ist unzulässig, die Nachricht unbefugt weiterzuleiten oder zu kopieren. Da wir nicht die Echtheit oder Vollständigkeit der in dieser Nachricht enthaltenen Informationen garantieren oder zusichern können, sind die vorstehenden Ausführungen rechtlich nicht bindend. Eine Haftung hierfür wird ausgeschlossen.</font></font><br>
<font size="2" face="Arial"><font size="2" face="Arial">This message is confidential. If you are not the intended recipient, we kindly ask you to inform the sender and delete the information. Any unauthorised dissemination or copying hereof is prohibited. As we cannot guarantee or assure the genuineness or completeness of the information contained in this message, the statements set forth above are not legally binding. Accordingly we cannot accept any liability for their contents.</font></font>