[syslog-ng] Issue with filtering messages and sending them

Fabien Wernli wernli at in2p3.fr
Thu Aug 6 16:52:51 CEST 2015


On Thu, Aug 06, 2015 at 04:43:16PM +0200, Cosmin Neagu wrote:
> source s_src {
>        system();
>        internal();
> };

reading the docs on "mark-mode()" you can see that it's set to "internal"
for "program()" destinations. Also: "When internal mark mode is selected,
internal source should be placed in the log path as this mode does not
generate mark by itself at the destination".

You *did* place "internal()" into the log path through "s_src" which
explains why the mark messages *are* routed through the logpath containing
your email program.

Now you have to find out why the filter isn't working.

What I'd also do if I were you is look up the native "smtp()" destination
which could simplify your config.


More information about the syslog-ng mailing list