Re: [syslog-ng] db-parser reuse for multiple logs?

8 Apr 2015

      I don't have an answer to your actual question, however, you can work around it by

log {
         source(src_udp);
         parser(myparser);
         log {
                 filter(filter_host1);
                 destination(dst_host1);
                 flags(final);
         };
         log {
                 filter(filter_host2);
                 destination(dst_host2);
                 flags(final);
         };
};

Hope that helps.

Evan.

On 04/08/2015 04:31 AM, Mikkel Leth Carlsen wrote:
...
Hi
Are db-parsers defined in syslog-ng configurations not reusable for multiple logs?  A simplified example (syslog 3.6.2):
parser myparser {
         db_parser(
                 file("/usr/local/etc/patterndb.d/myparser.xml")
         );
};
template mytemplate {
          template("${A};${B};${C}\n");
}
filter filter_host1 {
         netmask(10.0.0.1/255.255.255.255);
};
filter filter_host2 {
         netmask(10.0.0.2/255.255.255.255);
};
destination dst_host1 {
         file("host1.log" perm(0644) template(mytemplate));
};
destination dst_host2 {
         file("host2.log" perm(0644) template(mytemplate));
};
log {
         source(src_udp);
         filter(filter_host1);
         parser(myparser);
         destination(dst_host1);
         flags(final);
};
log {
         source(src_udp);
         filter(filter_host2);
         parser(myparser);
         destination(dst_host2);
         flags(final);
};
This seems to work as expected and 'syslog-ng -s' does not report any problems, but I see the following in the syslog-ng internal log:
Internal error, duplicate configuration elements refer to the same persistent config; name='db-parser(/usr/local/etc/patterndb.d/myparser.xml)'
Internal error, duplicate configuration elements refer to the same persistent config; name='db-parser(/usr/local/etc/patterndb.d/myparser.xml)'
/Mikkel
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Re: [syslog-ng] db-parser reuse for multiple logs?

Evan Rempel