David Hauck <davidh@netacquire.com> writes:
Couple things here: 1. If this is an error why doesn't 'syslog-ng -s' indicate it as such?
Because -s checks for syntax only, and this is not a syntax error, it's one level higher.
2. Other than the error, things appear to function correctly. Why is this?
That'd be a bit hard to explain without going into low-level details, but I'll try: it works because of luck, mostly. UDP destinations will not trip over each other when used like this. If you'd try that with files, all hell would break loose.
3. Other blocks do not require that their contents contain unique statements. For example, I can create filter blocks that have statements that intersect. Why not destination blocks?
Because filters generally don't have state, so they can't conflict with each other, they can work independently. For destinations, that's not the case. For example, if you'd have something like this: destination d_1 { file("/var/log/some.log"); udp(...); }; destination d_2 { file("/var/log/some.log"); tcp(...); }; That would break horribly, as two threads would try to write to the same file, and would write over each other, resulting in garbage. That doesn't happen with network destinations, but those have different issues. For example, if a network target goes down, and you had duplicates in your config, then they'd notice the target being down separately, increasing the chance you'll loose logs. If you had one target, and bound it to various sources in a log{} statement instead, then you'd only have one instance of the driver. -- |8]