[syslog-ng]Catch All Statement

[Richard E. Perlotto II]

A simple answer is to not have any filters and write a file until
you are sure that nothing is missing, or better yet, create an
inverse filter of all the other things you are filtering such that
only what you may have missed would be written to the file.


Richard

> -----Original Message-----
> From: syslog-ng-admin@lists.balabit.hu 
> [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi
> Sent: Thursday, April 10, 2003 3:17 PM
> To: syslog-ng@lists.balabit.hu
> Subject: Re: [syslog-ng]Catch All Statement
> 
> 
> On Thu, Apr 10, 2003 at 02:26:51PM -0700, Doug Peterson wrote:
> > Thanks Nate -- I'm not sure this applies to me though.
> > While yes that catches all specified levels, I was
> > hoping to utilize the fallback flag. My understanding
> > is that the fallback flag takes anything that hasn't
> > been logged up until the log statement in which the
> > fallback flag is in, gets logged to whatever
> > destination you specify.
> > 
> > Does the fallback flag do what I want? Also, I've read
> > the descriptions of the "catchall" flag, but I don't
> > fully understand it.. should I be using that instead?
> 
> Q: How can I filter messages so that only not-already-routed 
> lines will be routed/filtered again?
> 
> A: This is a catchall statement, and should catch all 
> messages which were not accepted any of the previous statements.
> 
>  log { source(src); filter(DEFAULT); destination(dst); };
> 
> <URL:http://www.campin.net/syslog-ng/faq.html#catchall>
> 
> Look at the "final" log flag to stop at that point/line and 
> not log the message again.
> 
> <URL:http://www.balabit.com/products/syslog_ng/reference/logpa
> th.html#AEN155>
> -- 
> Nate Campi    http://www.campin.net 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng@lists.balabit.hu 
> https://lists.balabit.hu/mailman/listinfo/sysl> og-ng
> 
> Frequently asked questions at 
> http://www.campin.net/syslog-ng/faq.html
> 
> 
>