On Apr 8, 2015 1:31 PM, "Mikkel Leth Carlsen" <mlca@tdc.dk> wrote:

Hi

Are db-parsers defined in syslog-ng configurations not reusable for multiple logs?  A simplified example (syslog 3.6.2):

parser myparser {
        db_parser(
                file("/usr/local/etc/patterndb.d/myparser.xml")
        );
};

template mytemplate {
         template("${A};${B};${C}\n");
}

filter filter_host1 {
        netmask(10.0.0.1/255.255.255.255);
};

filter filter_host2 {
        netmask(10.0.0.2/255.255.255.255);
};

destination dst_host1 {
        file("host1.log" perm(0644) template(mytemplate));
};


destination dst_host2 {
        file("host2.log" perm(0644) template(mytemplate));
};

log {
        source(src_udp);
        filter(filter_host1);
        parser(myparser);
        destination(dst_host1);
        flags(final);
};

log {
        source(src_udp);
        filter(filter_host2);
        parser(myparser);
        destination(dst_host2);
        flags(final);
};

This seems to work as expected and 'syslog-ng -s' does not report any problems, but I see the following in the syslog-ng internal log:

Internal error, duplicate configuration elements refer to the same persistent config; name='db-parser(/usr/local/etc/patterndb.d/myparser.xml)'
Internal error, duplicate configuration elements refer to the same persistent config; name='db-parser(/usr/local/etc/patterndb.d/myparser.xml)'

/Mikkel
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq