[syslog-ng]exit matching rules after first match
Fanselow, William
syslog-ng@lists.balabit.hu
Fri, 5 Sep 2003 09:25:41 -0600
This is a multi-part message in MIME format.
------_=_NextPart_001_01C373C1.F7520AB7
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Is there any way to configure syslog-ng to exit the matching rules upon
it's first match, much as most firewalls do (it appears that all
matching rules are checked even after a match has been made). This
would make my config file much simpler and presumably ease processing
resources. If this feature doesn't currently exist, wouldn't it be a
cool addition to future releases!
------------------------
William Fanselow
Level(3) Communications
720.888.8363
------------------------
------_=_NextPart_001_01C373C1.F7520AB7
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.0.6472.0">
<TITLE>exit matching rules after first match</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Arial">Is =
there any way to configure syslog-ng to exit</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"> <FONT SIZE=3D2 =
FACE=3D"Arial">the</FONT></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN =
LANG=3D"en-us"> <FONT SIZE=3D2 FACE=3D"Arial">matching rules upon =
it</FONT></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT =
SIZE=3D2 FACE=3D"Arial">’</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Arial">s first match, much as most firewalls =
do</FONT></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT =
SIZE=3D2 FACE=3D"Arial"></FONT> <FONT SIZE=3D2 =
FACE=3D"Arial">(i</FONT></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Arial">t appears that all matching =
rules are checked even after a match has been made</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Arial">)</FONT></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Arial">.</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Arial"> </FONT></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN =
LANG=3D"en-us"> <FONT SIZE=3D2 FACE=3D"Arial">This would make my config =
file much simpler and presumably ease processing</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Arial"> resources.</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Arial"> If this feature doesn</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Arial">’</FONT></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Arial">t currently exist, =
wouldn</FONT></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Arial">’</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Arial">t it be a co</FONT><FONT SIZE=3D2 =
FACE=3D"Arial">o</FONT><FONT SIZE=3D2 FACE=3D"Arial">l addition to =
future</FONT><FONT SIZE=3D2 FACE=3D"Arial"> releases!</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"></SPAN></P>
<P ALIGN=3DLEFT><SPAN LANG=3D"en"></SPAN><A NAME=3D""><SPAN =
LANG=3D"en"></SPAN><SPAN LANG=3D"en"><FONT SIZE=3D2 =
FACE=3D"Arial">------------------------</FONT></SPAN></A></P>
<P ALIGN=3DLEFT><SPAN LANG=3D"en"><FONT SIZE=3D2 FACE=3D"Arial">William =
Fanselow</FONT></SPAN></P>
<P ALIGN=3DLEFT><SPAN LANG=3D"en"><FONT SIZE=3D2 FACE=3D"Arial">Level(3) =
Communications</FONT></SPAN></P>
<P ALIGN=3DLEFT><SPAN LANG=3D"en"><FONT SIZE=3D2 =
FACE=3D"Arial">720.888.8363</FONT></SPAN></P>
<P ALIGN=3DLEFT><SPAN LANG=3D"en"><FONT SIZE=3D2 =
FACE=3D"Arial">------------------------</FONT></SPAN><SPAN =
LANG=3D"en-us"></SPAN><SPAN LANG=3D"en-us"></SPAN><SPAN =
LANG=3D"en"></SPAN></P>
<P ALIGN=3DLEFT><SPAN LANG=3D"en-us"></SPAN></P>
</BODY>
</HTML>
------_=_NextPart_001_01C373C1.F7520AB7--