[syslog-ng] Macro expansion in program destination

[Martin Holste]

> No, this is *not* what syslog-ng does. Syslog-ng does *not* pass the macro value
> for $S_DAY do the command line, and thus the 30 does *not* appear at all.

Yes, you are right--I thought it would but it doesn't.  I still don't
understand why you would need to do that.  You want to send a log to a
given program depending on the value of $S_DAY?

> You have identified exactly what I am talking about. Syslog-ng has done the receiving,
> and the parsing, and then needs to forward the message to
> an appropriate program destination based on the parsed information.

Then use a filter().  If your setup is so specific that filter() isn't
enough, then use something like Perl to route those messages.  That's
advanced decision making and should be done in a program.  I'd rather
see the Balabit guys focusing their efforts on other features.