[syslog-ng] Fail to write facility local0

[Geller, Sandor (IT)]

Hi,

> Hello,
> 
> I have this config file:
> 
> filter f_local0 { facility(local0); };
> filter f_local1 { facility(local1); };
> destination df_local1 {
>         file("/mnt/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/local.log"
>         template("$FULLDATE <> $PROGRAM <> $MSGONLY\n")
>         template_escape(no));
> };
> log {
>         source(s_tcp); source(s_internal); source(s_udp); 
> source(s_unix);
>         filter(f_local0); filter(f_local1);
>         destination(df_local1);
> };
> 
> 	
> When an event arrives at the system by facility local0 or local1, this
> one is registered in the file never. Can be some bug of syslog-ng or
> failure in config?

If I understand you correctly then the problem is that you're using two
filters which exclude each other however using more filters they are
logically AND-ed. If you want to catch messages from local0 and local1
use a filter like this:

filter f_local01 {
	facility(local0) or facility(local1);
};

Regards,

Sandor
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.