[syslog-ng] Internal error, duplicate configuration elements...

[Gergely Nagy]

David Hauck <davidh at netacquire.com> writes:

> Couple things here:
> 1. If this is an error why doesn't 'syslog-ng -s' indicate it as such?

Because -s checks for syntax only, and this is not a syntax error, it's
one level higher.

> 2. Other than the error, things appear to function correctly. Why is this?

That'd be a bit hard to explain without going into low-level details,
but I'll try: it works because of luck, mostly. UDP destinations will
not trip over each other when used like this. If you'd try that with
files, all hell would break loose.

> 3. Other blocks do not require that their contents contain unique
> statements. For example, I can create filter blocks that have
> statements that intersect. Why not destination blocks?

Because filters generally don't have state, so they can't conflict with
each other, they can work independently. For destinations, that's not
the case. For example, if you'd have something like this:

destination d_1 { file("/var/log/some.log"); udp(...); };
destination d_2 { file("/var/log/some.log"); tcp(...); };

That would break horribly, as two threads would try to write to the same
file, and would write over each other, resulting in garbage. That
doesn't happen with network destinations, but those have different
issues. For example, if a network target goes down, and you had
duplicates in your config, then they'd notice the target being down
separately, increasing the chance you'll loose logs. If you had one
target, and bound it to various sources in a log{} statement instead,
then you'd only have one instance of the driver.

-- 
|8]