[syslog-ng] classify/assign events to tenants/customers

Fabien Wernli wernli at in2p3.fr
Thu Sep 18 15:25:38 CEST 2014

Hi Sascha,

On Thu, Sep 18, 2014 at 06:53:04AM +0000, Lucas, Sascha wrote:
> * classification: pattern is per program and limited to the message

patterndb's "primary keys" are indeed (currently) limited to PROGRAM
(rulesets) and MESSAGE (patterns), although you can easily bypass that

> * correlation: context is limited to one host not many

You *can* correlate messages from different hosts by using 'context-scope =
global' in the rule

More information about the syslog-ng mailing list