hi,

if you reference a source from two log statements both will get a copy of the same message. in the 2nd statement you request to send messages to d_local without filtering. that includes your ip too.

ahh, i see you are using flags(final), that should do the trick if the message is received on the same source (e.g. s_network). are you sure this is the case?

also, you can start syslog-ng in the foreground, enabling debug messages which should help you to narrow the problem further down.

# syslog-ng -Fedv


----- Original message -----
> Hi guys,
>
> Just new, and created the following conf for testing purposes. The
> problem is that i get the logs in both destinations despite the filter.
>
> @version: 3.4
> @include "scl.conf"
>
> options {
>                keep_hostname(yes);
>                normalize_hostnames(yes);
>                threaded(yes);
>                ts_format(iso); # Adds TZ
>                #use_fqdn(yes);
>                use_dns(no);
> };
>
> source s_local {
>                system();
>                internal();
> };
>
> source s_network {
>                udp();
> };
>
> destination d_local {
>                file("/var/log/messages");
> };
>
> destination d_my_mac {
>                file("/var/log/mymac");
> };
>
> filter f_my_mac {
>                netmask(10.24.18.2/255.255.255.255);
> };
>
> log {
>                source(s_network);
>                filter(f_my_mac);
>                destination(d_my_mac);
>                flags(final);
> };
>
> log {
>                source(s_local);
>                # uncomment this line to open port 514 to receive messages
>                source(s_network);
>                #destination(d_central_udp);
>                destination(d_local);
> };
>
>
> as netmask i also tried cidr /24 and same thing. The problem is that i
> get the logs in both destinations. I only want to have them in my_mac
>
> Thanks!