A note about syslog-ng embedded log paths and the final flag

I’ve just spent some hours on investigating why the hell syslog-ng would log to two files while one logpath had the „final“-flag set. To share this lesson learned with you: The final-flag doesn’t do anything to embedded log statements. If you’ve read the syslog-ng handbook carefully (unlike me), you will already know this. Only top-level log-paths are responding to the final flag.

I tried to use embedded log paths to save some writing. See this:


log {
source(s_remote);
log {
filter(f_filter1);
destination(d_destination1);
flags(final);
};
log {
filter(f_filter2);
destination(d_destination2);
};
};


This way I could write the source-line only once for a bunch of log paths. However, the „flags(final);“ statement in the embedded log path with filter „f_filter1“ is never interpreted, as stated. So I copied the source statement to each logpath and made each one a top-level one. That worked.

Hope that clears something up for some of you.