Hello David, On Thu, Apr 17, 2014 at 04:21:34PM +0000, David Hauck wrote:
Great, thanks for clarifying this. I'd asked this originally because I thought that I'd seen that this wasn't happening (I must have mistook the result for something else). By extension then I guess that rulesets without 'program pattern' elements provide default rules for *any* incoming message with a non-zero $PROGRAM value (right?).
Quoting from the "syslog-ng-ose-v3.5-guide-admin", ยง13.5.3 "The syslog-ng pattern database format": "If the <pattern> element of a ruleset is not specified, syslog-ng OSE will use this ruleset as a fallback ruleset: it will apply the ruleset to messages that have an empty PROGRAM header, or if none of the program patterns matched the PROGRAM header of the incoming message." That seems pretty crystal clear to me :) cheers