[syslog-ng] Multiple log statements vs If/else

[Faine, Mark R. (MSFC-IS40)[NICS]]

Thanks, that does help and I am putting in a fallback log path as the last log path.  I think junction/channel is very difficult to understand.  If/else is probably the easiest, log paths aren’t that bad, but junction/channel is very unintuitive to me.

Thanks,
-Mark

Mark Faine
System Administrator
SAIC/NICS
215 Wynn Dr. 5065
Huntsville, AL 35805
256-961-1295 (Desk)
256-617-4861 (Work Cell)

From: syslog-ng <syslog-ng-bounces at lists.balabit.hu> On Behalf Of Nagy, Gábor
Sent: Friday, May 17, 2019 3:13 AM
To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
Subject: Re: [syslog-ng] Multiple log statements vs If/else

Hi Mark!

Sorry for answering after a long time.
> I am curious about how the declaration order matters.  My understanding is that each message will be evaluated for a match on each log statement in the order that they appear in the file and only when it hits a log statement with a final flag will it stop attempting to match.  Is that correct?
Yes. :)
As Fabien mentioned, a "fallback" log path would be need to not drop unprocessed log messages.

> ... it seems like to me that if they aren’t different it would be easier to do multiple log statements if generated dynamically.
A config with many log paths would be easy to generate, but hard to read/maintain.
If you find if-else config hard to generate from code, you can use the junction/channel with final flags too. Just make sure you have a fallback channel too.

Regards,
Gabor

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190517/ae94facc/attachment.html>