[syslog-ng] using VARARGS correctly
    Faine, Mark R. (MSFC-IS40)[NICS] 
    mark.faine at nasa.gov
       
    Tue May 18 18:00:36 UTC 2021
    
    
  
Syslog-ng 3.19 
block destination d_default(basepath('/var/log/remote/backup') location("") app("") name("")) {
    file("`basepath`/`location`/`app`/${HOST}/${HOST}_`app``__VARARGS__`.log"
    persist-name(`name`) create_dirs(yes)
    flags("threaded", "no-multi-line"));
};
However, when I call it like so:
d_default(basepath(`BASEPATH`) location("$location") app("$app") name('d_default_udp') "$session");
I get a syntax error when checking with --syntax-only
Error parsing block reference, syntax error, unexpected LL_STRING, expecting ')' in /etc/syslog-ng/conf.d/splunk.conf:
23                  categorize_loc();
24                  categorize_app();
25              };
26          };
27          destination {
28---->       d_default(basepath(`BASEPATH`) location("$location") app("$app") name('d_default_udp') "$session");
28---->                                                                                    ^^^^^^^^^^
>From looking at the documentation, it looks like it's a valid way to use it.  $session here is just a number from 0-9 that is set from rewriting a user defined macro from the message's sessionid field.  It's only going to exist for a certain kind of message.
Thanks,
-Mark
    
    
More information about the syslog-ng
mailing list