A simple answer is to not have any filters and write a file until you are sure that nothing is missing, or better yet, create an inverse filter of all the other things you are filtering such that only what you may have missed would be written to the file. Richard
-----Original Message----- From: syslog-ng-admin@lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: Thursday, April 10, 2003 3:17 PM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]Catch All Statement
On Thu, Apr 10, 2003 at 02:26:51PM -0700, Doug Peterson wrote:
Thanks Nate -- I'm not sure this applies to me though. While yes that catches all specified levels, I was hoping to utilize the fallback flag. My understanding is that the fallback flag takes anything that hasn't been logged up until the log statement in which the fallback flag is in, gets logged to whatever destination you specify.
Does the fallback flag do what I want? Also, I've read the descriptions of the "catchall" flag, but I don't fully understand it.. should I be using that instead?
Q: How can I filter messages so that only not-already-routed lines will be routed/filtered again?
A: This is a catchall statement, and should catch all messages which were not accepted any of the previous statements.
log { source(src); filter(DEFAULT); destination(dst); };
<URL:http://www.campin.net/syslog-ng/faq.html#catchall>
Look at the "final" log flag to stop at that point/line and not log the message again.
<URL:http://www.balabit.com/products/syslog_ng/reference/logpa th.html#AEN155> -- Nate Campi http://www.campin.net _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/sysl> og-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html