[syslog-ng] Multiple log statements vs If/else

[Faine, Mark R. (MSFC-IS40)[NICS]]

Thank you for the visualization.  So, if I currently  have a bunch of log paths that are final the channels forks would just expand out vertically, but then a junction could be used to join again for the fallback log path?  Embedded log paths would just be a fork off of an existing fork?

-Mark

From: syslog-ng <syslog-ng-bounces at lists.balabit.hu> On Behalf Of Scheidler, Balázs
Sent: Saturday, May 18, 2019 11:47 PM
To: Fabien Wernli <wernli at in2p3.fr>; Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
Subject: Re: [syslog-ng] Multiple log statements vs If/else

Just think about this as a pipeline that can:

1) deliver messages
2) fork to different paths and never join again (=> channel / log statement)
3) fork to different paths and then be joined again (=> junction)
4) at every fork, the message is cloned.

```

        +-- channel1 ---- destination
       /
src---+
       \                  /----\
        +-- channel 2----+      +----   destination
                          \----/
                         junction
```

On Sat, May 18, 2019 at 11:34 PM Fabien Wernli <wernli at in2p3.fr<mailto:wernli at in2p3.fr>> wrote:
On Fri, May 17, 2019 at 01:19:07PM +0000, Faine, Mark R. (MSFC-IS40)[NICS] wrote:
> Thanks, that does help and I am putting in a fallback log path as the last log path.  I think junction/channel is very difficult to understand.  If/else is probably the easiest, log paths aren’t that bad, but junction/channel is very unintuitive to me.

Channels are like individual if (without else) statements.
Junctions are channel containers, all channels being connected downstream.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.balabit.hu_mailman_listinfo_syslog-2Dng&d=DwMFaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=zMyZvtxRXMBKZZYKVMke9zplWK320p3d51BzuU4jwWo&m=Uw5d_HUFElK6wqnsGDq1ZGcABZhTnfrXdy46vSuctTA&s=_Q50XeAIAmDxFctsE3ni1BpIXHAhiFSV5TkjVFmzyQE&e=>
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.balabit.com_support_documentation_-3Fproduct-3Dsyslog-2Dng&d=DwMFaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=zMyZvtxRXMBKZZYKVMke9zplWK320p3d51BzuU4jwWo&m=Uw5d_HUFElK6wqnsGDq1ZGcABZhTnfrXdy46vSuctTA&s=UyYnZ-Kz4vqYuM4kBVijh7QO3bYgu6QOaN7HxK3UEr0&e=>
FAQ: http://www.balabit.com/wiki/syslog-ng-faq<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.balabit.com_wiki_syslog-2Dng-2Dfaq&d=DwMFaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=zMyZvtxRXMBKZZYKVMke9zplWK320p3d51BzuU4jwWo&m=Uw5d_HUFElK6wqnsGDq1ZGcABZhTnfrXdy46vSuctTA&s=p51NlYnRfTGTIdR1kCaNvEBZ_F9M0LcUz_TKr4F0wcA&e=>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190520/8fadb04f/attachment.html>