[syslog-ng] Value is dropped or unset in resolved destination template

[Nagy Gábor]

Hi Mark,

Fabien is right, you should have a default value.
You are using the rewrite rules that set $location inside an if statement.
Maybe what happens is that in some cases a log doesn't match which leads to
an unset $location.
Don't you have directories with $location's value too?
So you have both:
("`BASEPATH`//$(lowercase ${HOST})/$app/$(lowercase ${HOST})_$app.log"
("`BASEPATH`/$location/$(lowercase ${HOST})/$app/$(lowercase
${HOST})_$app.log"

Or $location is always empty on the destination side?

Gabor


Fabien Wernli <wernli at in2p3.fr> ezt írta (időpont: 2022. márc. 23., Sze,
15:04):

> Hi Mark,
>
> It's really hard to tell what's happening without seeing your full
> configuration. Remember messages can go through multiple logpaths, some of
> which the variables are probably empty in.
>
> That being said, if I were you I'd use a default value for your macros in
> any
> case, much safer e.g.:
>
>     destination d_default {
>             file("`BASEPATH`/${location:-hidden}/$(lowercase
> ${HOST})/${app:-unknown}/$(lowercase ${HOST})_${app:-unknown}.log"
>             create_dirs(yes)
>             flags("threaded", "no-multi-line"));
>     };
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20220323/57f94d5c/attachment.htm>