[syslog-ng] flags(final) in version 3.4

[Evan Rempel]

There was a patch with refarss to include statements tgat fixes this. Not a release yet but will be 3.4.2


----
Evan Rempel,  250-721-7691
Senior Systems Administrator
Data Centre Services, University of Victoria




-------- Original message --------
From: "Fanselow, William" <William.Fanselow at Level3.com>
Date:
To: syslog-ng at lists.balabit.hu
Subject: [syslog-ng] flags(final) in version 3.4


According to this report, the flags(final) does not work in 3.4 as one got used to in prior versions.
https://lists.balabit.hu/pipermail/syslog-ng/2013-February/020039.html

In version 3.3 I used flags(final) in each of my log{ } statements so that a message was not unnecessarily processed by anything beyond a matching filter.  My last entry in the config used flags(fallback) so that any message not previously sent to a destination was caught by this final stanza.

With version 3.4, the same syntax does not work, and all messages appear to be passing through every filter and getting duplicated in the first match and  my final log destination.

Surely, there must be another way to handle this sort of thing.  Not only is it useful for processing efficiency, but it is also a useful way to identify "unmatched" filters in the config.

Any suggestions for replicating the 3.3 behavior would be appreciated.

Thanks
Bill Fanselow
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20130313/be92410f/attachment.htm