Thanks, that does help and I am putting in a fallback log path as the last log path. I think junction/channel is very difficult to understand. If/else is probably the easiest, log paths aren’t that bad, but junction/channel is very unintuitive to me. Thanks, -Mark Mark Faine System Administrator SAIC/NICS 215 Wynn Dr. 5065 Huntsville, AL 35805 256-961-1295 (Desk) 256-617-4861 (Work Cell) From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> On Behalf Of Nagy, Gábor Sent: Friday, May 17, 2019 3:13 AM To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Subject: Re: [syslog-ng] Multiple log statements vs If/else Hi Mark! Sorry for answering after a long time.
I am curious about how the declaration order matters. My understanding is that each message will be evaluated for a match on each log statement in the order that they appear in the file and only when it hits a log statement with a final flag will it stop attempting to match. Is that correct? Yes. :) As Fabien mentioned, a "fallback" log path would be need to not drop unprocessed log messages.
... it seems like to me that if they aren’t different it would be easier to do multiple log statements if generated dynamically. A config with many log paths would be easy to generate, but hard to read/maintain. If you find if-else config hard to generate from code, you can use the junction/channel with final flags too. Just make sure you have a fallback channel too.
Regards, Gabor