[syslog-ng] Creating a "log" block (OSE 3.2.1)

Balazs Scheidler bazsi at balabit.hu
Wed Dec 8 22:04:21 CET 2010


On Wed, 2010-12-08 at 09:38 +0100, Fekete Robert wrote:
> Update from Bazsi:
> changing the type of the block to root should workaround the problem.

Yes, that's what I said when I stumbled into Robert on the corridor. But
now as I see the use-case, I can say that there's no "log" context for
blocks right now.

Hmm.. here's a proof-of-concept patch to introduce block support in log
statement. It is not perfect as the ';' has to match exactly (e.g. you
need to skip the ';' in the block, all the others ignore multiple
semicolons now)

This is as far as I could get it within 5 minutes, and I'd appreciate if
you could improve it.

Thanks.

> 
> Robert
> 
> Fekete Robert wrote:
> 
> > 
> > Eric Berggren wrote:
> > 
> >> Howdy
> >>
> >> Looking to use the new fancy "block" construct in syslog-ng 3.2.1 (OSE) -- (the example in the documentation [5.3.2] doesn't parse, but figured out needs to include ()'s as well in the block definition).
> > 
> > Hi,
> > 
> > thanks for noticing this error. I've corrected it in the source repo of the 
> > adminguide, and will update the docs on the website when someone tells me if 
> > using {} within blocks is permitted (but now buggy) or forbidden.
> > 
> > Regards,
> > 
> > Robert
> > 
> >> Meanwhile, trying to define a "log" block, that contains other log {} stanza's, but fails to parse:
> >>
> >>     filter f_zort { level(err); };
> >>     destination d_weblog_unknown { file("/tmp/foo"); };
> >>
> >>     block log bl_weblog() {
> >>         filter(f_zort);
> >>         log { destination(d_weblog_unknown); };
> >>     };
> >>   
> >>     Error parsing main, syntax error, unexpected '}', expecting $end in /usr/local/etc/syslog-ng.d/10-weblog at line 7, column 1: included from /etc/syslog-ng.conf line 15, column 37
> >>
> >>     >> }; <<
> >>
> >> The idea being I would include this within another "log { }" stanza in the main file.
> >>
> >> If I remove "log { destination(...); };" from the "bl_weblog()" block, it parses okay.  I have another ("destination") block within the config that also parses okay (even parameterized). Strangely, commenting out the entry with a "#" at the start of that line still results in a syntax error. The error is independent of whether bl_weblog() is even referenced anywhere.
> >>
> >> The main config may include only 'include "10-weblog"' and nothing else to demonstrate.
> >>
> >> Seems otherwise a valid scenario, no ?
> >>
> >> thanks,
> >> -eric
> >>
> >> ______________________________________________________________________________
> >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> >> FAQ: http://www.campin.net/syslog-ng/faq.html
> >>
> >>
> > 
> > ______________________________________________________________________________
> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> > FAQ: http://www.campin.net/syslog-ng/faq.html
> > 
> > 
> 
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
> 

-- 
Bazsi
-------------- next part --------------
A non-text attachment was scrubbed...
Name: q
Type: text/x-patch
Size: 1802 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20101208/63ab4a0d/attachment.bin 


More information about the syslog-ng mailing list