[syslog-ng] log action or discard ?

18 Nov 2009

      Hello,

I have a syslog server that receives syslog messages and will forward a
selection of them to a central host via TLS.  It will log all other
messages to a local file.  The current configuration looks something
like this:

destination forward {
	syslog(<options here>);
};

destination all {
	file("/var/log/all");
};

filter forward {
	match("mumble");
};

log {
	all-my-sources
	filter(forward);
	destination(forward);
	flags(final);
};

log {
	all-my-sources
	destination(all);
};

Now if my remote server to which I'm forwarding messages to goes down or
stops accepting connections for any reason, _all_ my logging will come
to a grinding halt.  That is, nothing gets appended to /var/log/all.

What I want is for my forwarding to be a "try this or discard" kind of
scenario.  That is, if I can't forward the messages, just drop them, but
continue to log all other messages unphased.

Is that possible?  If so, how?

Thanks in advance,
-Jan

[syslog-ng] log action or discard ?

Jan Schaumann