'Re: [syslog-ng] Issue with filtering messages and sending them'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       syslog-ng
Subject:    Re: [syslog-ng] Issue with filtering messages and sending them
From:       Cosmin Neagu <cosmin.neagu01 () gmail ! com>
Date:       2015-08-10 17:45:21
Message-ID: 55C8E331.4060700 () gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]

Yeap, actually after reading the doc, this is how I fixed it

Best Regards
Cosmin Neagu

On 8/10/2015 9:26 AM, Scheidler, Balázs wrote:
>
> Also you can set mark-mode() to none which filters out all mark messages.
>
> On Aug 6, 2015 4:52 PM, "Fabien Wernli" <wernli@in2p3.fr 
> <mailto:wernli@in2p3.fr>> wrote:
>
>     Hi,
>
>     On Thu, Aug 06, 2015 at 04:43:16PM +0200, Cosmin Neagu wrote:
>     > source s_src {
>     >        system();
>     >        internal();
>     > };
>
>     reading the docs on "mark-mode()" you can see that it's set to
>     "internal"
>     for "program()" destinations. Also: "When internal mark mode is
>     selected,
>     internal source should be placed in the log path as this mode does not
>     generate mark by itself at the destination".
>
>     You *did* place "internal()" into the log path through "s_src" which
>     explains why the mark messages *are* routed through the logpath
>     containing
>     your email program.
>
>     Now you have to find out why the filter isn't working.
>
>     What I'd also do if I were you is look up the native "smtp()"
>     destination
>     which could simplify your config.
>
>     Cheers
>
>     ______________________________________________________________________________
>     Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>     Documentation:
>     http://www.balabit.com/support/documentation/?product=syslog-ng
>     FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>

[Attachment #5 (text/html)]

<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    Yeap, actually after reading the doc, this is how I fixed it<br>
    <pre class="moz-signature" cols="72">Best Regards
Cosmin Neagu</pre>
    <div class="moz-cite-prefix">On 8/10/2015 9:26 AM, Scheidler, Balázs
      wrote:<br>
    </div>
    <blockquote
cite="mid:CANWQT2OUyZ0FgoNaMbYOrjkTxYURmOE+GD3ehbMRy2U2E=ohsg@mail.gmail.com"
      type="cite">
      <p dir="ltr">Also you can set mark-mode() to none which filters
        out all mark messages.</p>
      <div class="gmail_quote">On Aug 6, 2015 4:52 PM, "Fabien Wernli"
        &lt;<a moz-do-not-send="true" \
href="mailto:wernli@in2p3.fr">wernli@in2p3.fr</a>&gt;  wrote:<br type="attribution">
        <blockquote class="gmail_quote" style="margin:0 0 0
          .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
          <br>
          On Thu, Aug 06, 2015 at 04:43:16PM +0200, Cosmin Neagu wrote:<br>
          &gt; source s_src {<br>
          &gt;        system();<br>
          &gt;        internal();<br>
          &gt; };<br>
          <br>
          reading the docs on "mark-mode()" you can see that it's set to
          "internal"<br>
          for "program()" destinations. Also: "When internal mark mode
          is selected,<br>
          internal source should be placed in the log path as this mode
          does not<br>
          generate mark by itself at the destination".<br>
          <br>
          You *did* place "internal()" into the log path through "s_src"
          which<br>
          explains why the mark messages *are* routed through the
          logpath containing<br>
          your email program.<br>
          <br>
          Now you have to find out why the filter isn't working.<br>
          <br>
          What I'd also do if I were you is look up the native "smtp()"
          destination<br>
          which could simplify your config.<br>
          <br>
          Cheers<br>
          <br>
______________________________________________________________________________<br>
          Member info: <a moz-do-not-send="true"
            href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"
            rel="noreferrer" \
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>  \
                Documentation: <a moz-do-not-send="true"
            href="http://www.balabit.com/support/documentation/?product=syslog-ng"
            rel="noreferrer" \
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
  FAQ: <a moz-do-not-send="true"
            href="http://www.balabit.com/wiki/syslog-ng-faq"
            rel="noreferrer" \
target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>  <br>
        </blockquote>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">______________________________________________________________________________
 Member info: <a class="moz-txt-link-freetext" \
href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>

Documentation: <a class="moz-txt-link-freetext" \
href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>

FAQ: <a class="moz-txt-link-freetext" \
href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>

</pre>
    </blockquote>
    <br>
  </body>
</html>

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

[prev in list] [next in list] [prev in thread] [next in thread] 