Thank you for the answer. Seems to be what I am looking for, but I am not able to make it works : log { source(stunnel); filter(f_apache); destination(remoteclient_apache); flags(final); }; Any idea ? I am running syslog-ng :3.1.3 on debian squeeze. Regards, On 11 April 2012 12:12, Gergely Nagy <algernon@balabit.hu> wrote:
Hugo Deprez <hugo.deprez@gmail.com> writes:
The issue is that my apache2 logs match other filter, so I am logging messages 3 times : [...] I would like to know how do you deal with this kind of situation ?
Put your apache2 logpath first, and use flags(final):
log { source(s_whatever); filter(f_apache); destination(d_whatever); flags(final); };
The flags(final) option will tell syslog-ng to stop processing the message there and then: it won't be sent forward to the rest of the logpaths.
Hope this helps!
-- |8]
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq