A note about syslog-ng embedded log paths and the final flag
7. Oktober 2013
I’ve just spent some hours on investigating why the hell syslog-ng would log to two files while one logpath had the „final“-flag set. To share this lesson learned with you: The final-flag doesn’t do anything to embedded log statements. If you’ve read the syslog-ng handbook carefully (unlike me), you will already know this. Only top-level log-paths are responding to the final flag.
I tried to use embedded log paths to save some writing. See this:
This way I could write the source-line only once for a bunch of log paths. However, the „flags(final);“ statement in the embedded log path with filter „f_filter1“ is never interpreted, as stated. So I copied the source statement to each logpath and made each one a top-level one. That worked.