Jay Guerette on Tue, Dec 04, 2001 at 04:28:24PM -0500: Jay,
A message could be sent to the external process via STDIN, it is evaluated and conditionally sent back via STDOUT. If a message is to be dropped according to the filter criteria of the external process, it would have to sendback a NULL character to syslog-ng as an indicator. [..] I realize that you could set up a program as a destination, and have that program filter and format and re-send those messages to syslog, but that seems cumbersome, and also could potentially double the processing that syslog-ng would have to do.
I don't see much difference vs. setting up a FIFO source and a program destination. To avoid overhead, you can direct input from the FIFO source directly to its destination. Have your external filter send out- put to the pipe and there you go. Regards, -- ____ ____ / _/| - > Gregor Binder <gb@(rootnexus.net|sysfive.com)> | / || _\ \ \__ Id: 0xE2F31C4B Fp: 8B8A 5CE3 B79B FBF1 5518 8871 0EFB AFA3 E2F3 1C4B