0

I set up a configuration where messages are classified and written into corresponding files (destinations). I'm wondering -- is it possible to log to a file messages that are not grabbed by specific filters?

For example, there are filters for dhcpd, dhclient, acpid, sshd messages. And what I want is to grab messages that are not falling into all 4 categories above.

I see tags are available as an internal per-message structure. I tried to set a mark for every category and grab untagged like this:

rewrite r_set_routed { set-tag('routed'); };
filter f_untagged { not tags('routed'); };
filter f_dhcpd_program { program('dhcpd'); };
<...>
log { source(s_local); rewrite(r_set_routed); filter(f_dhcpd_program); destination(d_dhcpd_file); };
<...>
log { source(s_local); filter(f_untagged); destination(d_unfiltered_file); };

But this is not working (looks like r_set_routed rewrite in one log {} does not affect other log {}). I know that it's possible to negate all filters to produce not-matching-everything-above filter, but that is error-prone and dirty way which I want to avoid.

Improve this question

1 Answer 1

Reset to default
1

use the 'flags(final)' option in your log paths that have filters, and log path for the untagged messages at the end. This last log path will not need filters or flags. For details, see https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-logflags.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .