[syslog-ng] Problem using tags with syslog-ng 3.1

[Lance Laursen]

On Fri, Apr 2, 2010 at 1:25 AM, SZALAY Attila <sasa at balabit.hu> wrote:

> Hi All!
>
> On Thu, 2010-04-01 at 11:37 -0600, Martin Holste wrote:
> > Ok, I think I see what you're saying: the tag only exists on the local
> > box and does not get forwarded in the message.  You were saying you
> > have to overwrite the original program with some other value so that
> > the tag is permanent and will survive multiple relays.  Sorry for the
> > confusion.
>
> Try to think about the tags as a sticky note on a package. When I want
> to create a lot of uniform white bag I put a sticky note into it, so I
> can make a difference between them. But after I write the correct
> adresses I take off the notes from it. In the example the tag is not
> surviving the relays, He put the tag _value_ into an another field. Just
> like if I put some information into the destination address to my mail.
>
> But I think that the idea of the persistant tags is great. And in the
> new syslog protocol there is space for it. I will create a feature
> request for it. :)
>
>
I agree. When tagging was first announced I was disappointed that they would
not survive relays. Program_override is a way to 'tag' relayed messages, but
it seems like a work-around (just like, say, using templates to add a custom
string before $MSG to filter for at your receiving host). In a large setup,
matching by host or other means is not manageable (especially if you want
your configs to be multi-site compatible), so I think persistent tags would
be a useful feature when sending from syslog-ng to syslog-ng.

-- 
Lance Laursen
Demonware Systems Engineer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100402/c3f88322/attachment.htm