[syslog-ng] Embedded log paths (was Re: using correlation to filter out some messages ?)

[Guillaume Rousse]

Le 05/02/2011 14:27, Balazs Scheidler a écrit :
> hmm... reemitted messages are coming in the internal() source, and in
> case you don't have that in your configuration file anywhere, it might
> come out on stdout.
I do.

However, I found the issue reading the documentation about embedded log
statements (big fat warning in 8.1.2 section):
The final, fallback, and catchall flags apply only for the top-level log
paths, they have no effect on embedded log paths.

Just moving the flags(final) statement from second inner log bloc to the
outer bloc was enough to fix this specific issue.

May I suggest a slight rephrasing of the warning, tough ? final flags
inside embedded log path do have an effect on other log path at the same
depth.

In this first case, the final flag prevent filtered message in the first
inner log path to be passed to the second inner path, for instance:
log {
    source(s_sys);

    log {
        filter(f_drop);
        destination(d_drop);
        flags(final);
    };

    log {
        destination(d_ldap);
    };
};
-- 
BOFH excuse #372:

Forced to support NT servers; sysadmins quit.