[syslog-ng] Impossibility to use multiple occurences of the same parser

Matthew Hall mhall at mhcomputing.net
Tue Feb 1 20:04:37 CET 2011


On Tue, Feb 01, 2011 at 03:46:02PM +0100, Guillaume Rousse wrote:
> This is incorrect, because parser(p_db) is used in two different log
> statements, and syslog-ng doesn't start with a cryptic message:
> Error initializing message pipeline;
> 
> If I try to use the parser only once, in the main file, tagging doesn't
> occur.
> 
> The only solution I found was to declare two different parsers, for each
> of the two files. As they both use a different pattern db fragment, it
> reduce the interest of merging them into a single pattern db file with
> update-patterndb.

I already reported this one a while ago.

You can take the same merged patterndb file and make different two differnet parser definitions to work around it.

Alternatively, a bug fix was introduced into later versions, you could try building from here and see if it's fixed:

git://git.balabit.hu/bazsi/syslog-ng-3.2.git

Matthew.


More information about the syslog-ng mailing list