What problem are you trying to solve? Simply put a catch-all log definition to the end of your configuration.
At 3 AM last night I realized that you need: # catch all messages that haven't qualified for other # destination{}'s yet log { source(src); destination(messages); flags(fallback); }; # catch a copy of all messages that were flagged for secondary # destinations{}'s already, but not flagged finalized, such # as those sent to a PIPE/FIFO via program(), for which we also # want a log file copy of log { source(src); destination(messages); }; Anyway it's ugly. But, keeping these configs graceful at this point is ...well, moot. ~BAS
-- Sandor Geller wildy@balabit.hu _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."