Hi Mark, Fabien is right, you should have a default value. You are using the rewrite rules that set $location inside an if statement. Maybe what happens is that in some cases a log doesn't match which leads to an unset $location. Don't you have directories with $location's value too? So you have both: ("`BASEPATH`//$(lowercase ${HOST})/$app/$(lowercase ${HOST})_$app.log" ("`BASEPATH`/$location/$(lowercase ${HOST})/$app/$(lowercase ${HOST})_$app.log" Or $location is always empty on the destination side? Gabor Fabien Wernli <wernli@in2p3.fr> ezt írta (időpont: 2022. márc. 23., Sze, 15:04):
Hi Mark,
It's really hard to tell what's happening without seeing your full configuration. Remember messages can go through multiple logpaths, some of which the variables are probably empty in.
That being said, if I were you I'd use a default value for your macros in any case, much safer e.g.:
destination d_default { file("`BASEPATH`/${location:-hidden}/$(lowercase ${HOST})/${app:-unknown}/$(lowercase ${HOST})_${app:-unknown}.log" create_dirs(yes) flags("threaded", "no-multi-line")); };
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq