[syslog-ng] Bazsi's blog: syslog-ng flexibility improvements

[Balazs Scheidler]

On Mon, 2012-01-16 at 09:22 -0500, Patrick Hemmer wrote:

> > source s_apache {
> >   log {
> >     source { file("/var/log/apache/error.log"); };
> >     parser(p_apache_parser); };
> >   };
> > };
> > 
> > log { source(s_apache); ... };
> > 
> 
> This just doesnt feel right. I'm not quire sure how else to put it :-)
> I mean that I think of `log` statements as output handlers for a
> message. They control how the message leaves syslog-ng, whether it be
> to a file, database, pipe, whatever. To me it seems to make more sense
> if the `log` statement is called something else here (inside the
> `source` block), though what I dont know. Maybe at the least an alias,
> so that log and the alias are the exact same things, but that reading
> the config would make it look more logical. 

Sure, I was also thinking hard what keywords to use in this case.
Internally a log {} is called a "sequence", but sure an alias would be
easy to do.

Do you perhaps have a suggestion? I'm not a native English speaker, thus
naming thing is sometimes difficult for me.


> I dont know if I'm understanding the distinctions between `log` and
> `junctions` properly, but it seems as if `log`s are a serial execution
> of the statements within, and `junction`s are a parallel execution of
> the statements within, so maybe names to better reflect this?

The functionality is exactly as you have described.

> 

-- 
Bazsi