[syslog-ng] Syslog-ng apache filters

[Hugo Deprez]

Thank you for the answer.

Seems to be what I am looking for, but I am not able to make it works :

log { source(stunnel); filter(f_apache); destination(remoteclient_apache);
flags(final); };

Any idea ?

I am running syslog-ng :3.1.3 on debian squeeze.

Regards,


On 11 April 2012 12:12, Gergely Nagy <algernon at balabit.hu> wrote:

> Hugo Deprez <hugo.deprez at gmail.com> writes:
>
> > The issue is that my apache2 logs match other filter, so I am logging
> > messages 3 times :
> [...]
> > I would like to know how do you deal with this kind of situation ?
>
> Put your apache2 logpath first, and use flags(final):
>
> log {
>  source(s_whatever);
>  filter(f_apache);
>  destination(d_whatever);
>  flags(final);
> };
>
> The flags(final) option will tell syslog-ng to stop processing the
> message there and then: it won't be sent forward to the rest of the
> logpaths.
>
> Hope this helps!
>
> --
> |8]
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120411/0aa231c3/attachment.htm