Hi... I'm running Syslog-ng 1.4.3 as a loghost and on a workstation behind a gateway... both RedHat 6.1 hmmm problems i've found... '#' seems to work not correctly... i've comment a few things in my syslog-ng.conf... and if the comment was not at the beginning of a line.. i got a parsing error.. '#' seems not to comment out log, source, ... -statements.... if i comment out the destination and filter rule for ppp from the standart debian example syslog-ng.conf .... i got a parsing error... saying something like... ppp was an unresolve identifer... and here my sugestions... what about ...say 'virtual pipes'.... or bracket rules... what i meen is... if you have a logingstatement like this log {source(src1); filter(f_1); source(src2); destination(dst1); }; (this seems to work on my maschine... throu this is not documented) and you now want to filter src2 with another filter.... when filter f_2 will filter both.... and not just the 2nd source... There would be something like a internal pipe helpy... So you define a pipe and use this to curving around the 2nd source and filter... or what would be even better... to create brackets around the 2nd source and filter... so the filter will just afect src2.... customized macros... what about just defining your own macros... say like constants... for example you can define LOGDIR="/var/log"; and then in a destination-rule it will sound like destination warn {file("$LOGDIR/warn");}; ....or just... FNW="not filter(warn);"; but i thing macros an const have to be captalized by definition... Felix... ICQ: 5227897/samon007 PS:Thanxs for writing this great programm...
Felix Meulenkamp wrote:
'#' seems to work not correctly... i've comment a few things in my syslog-ng.conf... and if the comment was not at the beginning of a line.. i got a parsing error..
I believe that this is by design and fairly standard. From what I've seen in most other apps that use configuration scripts, if the first character is whitespace, then that line is parsed -- even if the first non-whitespace character is a "#" for a comment.
'#' seems not to comment out log, source, ... -statements.... if i comment out the destination and filter rule for ppp from the standart debian example syslog-ng.conf .... i got a parsing error... saying something like... ppp was an unresolve identifer...
Did you also remember to remove the log entry on that one (ppp)? If you comment out the destination and filter, but not the log, I believe you still get a parsing error. Basically, just do a quick grep and see if you have any lines with ppp that are not commented out. I also commented out the ppp lines from the debian example and it ignored them fine for me. - John...
Hi... I'm running Syslog-ng 1.4.3 as a loghost and on a workstation behind a gateway... both RedHat 6.1
hmmm problems i've found...
'#' seems to work not correctly... i've comment a few things in my syslog-ng.conf... and if the comment was not at the beginning of a line.. i got a parsing error..
'#' seems not to comment out log, source, ... -statements.... if i comment out the destination and filter rule for ppp from the standart debian example syslog-ng.conf .... i got a parsing error... saying something like... ppp was an unresolve identifer...
I'll check this out.
and here my sugestions...
what about ...say 'virtual pipes'.... or bracket rules... what i meen is... if you have a logingstatement like this log {source(src1); filter(f_1); source(src2); destination(dst1); }; (this seems to work on my maschine... throu this is not documented) and you now want to filter src2 with another filter.... when filter f_2 will filter both.... and not just the 2nd source... There would be something like a internal pipe helpy... So you define a pipe and use this to curving around the 2nd source and filter... or what would be even better... to create brackets around the 2nd source and filter... so the filter will just afect src2....
What about using several log statements: log { source(src1); filter (f_1); destination(dst1); }; log { source(src1); filter (f_2); destination(dst1); };
customized macros... what about just defining your own macros... say like constants... for example you can define LOGDIR="/var/log"; and then in a destination-rule it will sound like destination warn {file("$LOGDIR/warn");}; ....or just... FNW="not filter(warn);"; but i thing macros an const have to be captalized by definition...
You could preprocess your files with cpp or m4. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
I'm running Syslog-ng 1.4.3 as a loghost and on a workstation behind a gateway... both RedHat 6.1
hmmm problems i've found...
'#' seems to work not correctly... i've comment a few things in my syslog-ng.conf... and if the comment was not at the beginning of a line.. i got a parsing error..
syslog-ng accepted comments if they begin at the first position. Does this patch help? diff -u -r1.9.2.2 cfg-lex.l --- cfg-lex.l 2000/03/24 10:57:28 1.9.2.2 +++ cfg-lex.l 2000/05/26 08:36:08 @@ -136,7 +136,7 @@ %x qstring %% -^\#.*$ ; +\#.*$ ; \n { linenum++; } {white}+ ; \.\. { return DOTDOT; }
'#' seems not to comment out log, source, ... -statements.... if i comment out the destination and filter rule for ppp from the standart debian example syslog-ng.conf .... i got a parsing error... saying something like... ppp was an unresolve identifer...
I couldn't reproduce this problem. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
participants (3)
-
Balazs Scheidler
-
Felix Meulenkamp
-
John Goggan