[syslog-ng] log route problem

[Marcin Orlowski]

Hi,

I setup client with mostly default settings. To log to remote server
I added (remote server listens on 514 as by default):

log { destination(d_remote); flags(catchall); };

this used to work pretty ok. So now I wanted to log xferlog too. Set
the source:

source s_ftp_xfer  { file("/var/log/proftpd/xferlog" follow_freq(2)
flags(no-parse)); };
destination d_remote_515 { tcp('x.x.x.x' port(515)); };
log { source(s_ftp_xfer); destination(d_remote_515); };

Port 515 is intentional here for other reasons. On the server:

source s_xferlog {tcp( ip(0.0.0.0) port(515)); };
template t_ftp { template("$MSG\n"); template_escape(no); };
destination df_ftp_xfer { ("/<PATH>/xferlog" template(t_ftp)); };
filter f_proftpd { program('^proftpd$'); };
log {
         source(s_xferlog);
         filter( f_proftpd );
         destination(df_ftp_xfer);
         flags(final);
};

My problem is that everytime xferlog entry arrives to the server
it's being added to xferlog as expected, but it also goes into syslog
and console. I am stuck to find out why. There's no other rule that
touches s_xferlog on the server. Any hints appreciated.

Marcin