[syslog-ng]Filter enhancement

[Gregor Binder]

Jay Guerette on Tue, Dec 04, 2001 at 04:28:24PM -0500:

Jay,

> A message could be sent to the external process via STDIN, it is evaluated
> and conditionally sent back via STDOUT. If a message is to be dropped
> according to the filter criteria of the external process, it would have to
> sendback a NULL character to syslog-ng as an indicator.
[..]
> I realize that you could set up a program as a destination, and have that
> program filter and format and re-send those messages to syslog, but that
> seems cumbersome, and also could potentially double the processing that
> syslog-ng would have to do.

I don't see much difference vs. setting up a FIFO source and a program
destination. To avoid overhead, you can direct input from the FIFO
source directly to its destination. Have your external filter send out-
put to the pipe and there you go.

Regards,

-- 
 ____ ____ 
/  _/| -  >  Gregor Binder <gb@(rootnexus.net|sysfive.com)>
| / || _\ \
\__ Id: 0xE2F31C4B Fp: 8B8A 5CE3 B79B FBF1 5518 8871 0EFB AFA3 E2F3 1C4B