Re: [syslog-ng]Filter enhancement

...

I realize that you could set up a program as a destination, and have that program filter and format and re-send those messages to syslog, but that seems cumbersome, and also could potentially double the processing that syslog-ng would have to do.

I don't see much difference vs. setting up a FIFO source and a program destination. To avoid overhead, you can direct input from the FIFO source directly to its destination. Have your external filter send out- put to the pipe and there you go.

I don't understand what you're suggeting here. I have no flexibility for source;it's good old UDP syslog or nothing. Are you saying take the UDP in, send it toa program, which writes it to a FIFO, that syslog-ng reads, and writes to a log? I'm confused...