Many thanks for the replies, i've just tested proposed solution and it seems to work as expected. Thanks again and wish You all a nice day. -- Tomáš Novosad LinuxBox.cz, s.r.o. 28. října 168, 709 00 Ostrava tel.: +420 591 166 221 mobil: +420 737 238 655 email: tomas.novosad@linuxbox.cz jabber: novosad@linuxbox.cz www.linuxbox.cz mobil servis: +420 737 238 656 email servis: servis@linuxbox.cz On 18. 2. 07:15, Balazs Scheidler wrote:
The multiple embedded log statement is the expected solution as Evan wrote. You can even use move common processing elements upwards, before the first embedded log statement so they get applied before both paths.
The dst, filter, dst should also work though. I'll check that. On Feb 17, 2014 5:13 PM, "Evan Rempel" <erempel@uvic.ca> wrote:
A while back I recall something related to multiple destinations in the same log statement and flow control issues.
Try this
log { source(pipe_load); parser(maillog); #-- parse message details log { filter(f_sendmail); #-- basic filter for sendmail program destination(maillog_base); #-- store message in tableA - basic info only flags(flow-control); }
log { filter(f_sendmail_from_or_to); #-- filter only messages which have "from" or "to" address defined destination(maillog_detail); #-- strore the deatiled info into tableB flags(flow-control); } }
Evan.