Hi, Finally found some time to test this. My setup is rather simple (I think), the config-file now says: destination d_syslogblock { pseudofile ("/proc/net/xt_recent/syslogblock" template("+${usracct.device}\n")); file("/var/log/syslogblock"); file("/tmp/blocker" template("+${usracct.device}\n")); }; The "blocker" file is just for testing purposes. and "syslogblock" is to log all evil to a regular log file as well. I got it to work rather easily and will report my findings. In the mean time, a question: is there anyone who guards the debian/ directory inside the source tree? There seem to be some (mostly minor) issues, and as I'm fixing them locally in order to get syslog-ng up and running, I may as well send them upstream. If anyone cares ;-) that is. Best regards, Valentijn On 12/30/13 19:16, Balazs Scheidler wrote:
I have now submitted a pull request to merge the "pseudofile" destination, I've now skipped the support for destination file templates, but that can be added later on when a more concrete usecase shows up. It already solves Valentijn's use-case, so it is useful as it is.