syslog-ng 系列连载-23 ：日志路径的定义

3.5. Log paths

Log paths determine what happens with the incoming log messages. Messages coming from the sources listed in the log statement and matching all the filters are sent to the listed destinations.

# 注释 ：log paths 决定了对于进入的日志采取什么动作。log paths 是由 log 语句定义的，它组合了 source 和 destination ，filter ，flags

# 所有匹配 filter 的消息将被送到每个 destiantion 。

To define a log path, add a log statement to the syslog-ng configuration file using the following syntax:

# 注释 ：下面是 log paths 的定义格式 ，可以看到 log 不需要对象名，这是和 source 、destination 定义不同的地方之一。

log {
    source(s1); source(s2); ... 
    filter(f1); filter(f2); ... 
    destination(d1); destination(d2); ... 
    flags(flag1[, flag2...]); 
    };
        

	Warning
	Log statements are processed in the order they appear in the configuration file. # 注释 ：注意！log 语句是按照它们在配置文件中的顺序一次处理的。

	Example 3.6. A simple log statement
	The following log statement sends all messages arriving to the localhost to a remote server. # 注释 ：下面定义了一个 source、一个 destination 和 一个 log path # 其中 log 表示把来自 s_localhost 这个 source 的日志都送到 d_tcp 这个 destination source s_localhost { tcp(ip(127.0.0.1) port(1999) ); }; destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); }; log { source(s_localhost); destination(d_tcp); };

All matching log statements are processed by default, so a single log message might be sent to the same destination several times, provided the destination is listed in several log statements.

# 注释 ：如果一个 destination 出现在多个 log 定义中，则可能一个消息会被重复发到同一个 destination 中。

This default behavior can be changed using the flags() parameter. Flags apply to individual log paths; they are not global options. The following flags available in syslog-ng:

# 注释 ：flags （）用于控制 syslog-ng 的默认行为。可用的参数值有 ：

#     -）1、final ：表示这是最后一个 destination 了，即使匹配其他的 log 语句，也不再发送消息

#      -）2、fallback ：处理其他 log paths 没有处理的消息

#     -）3、catchall ：处理所有消息，不管它们的 source 是什么

#     -）4、flow-control ：如果 destination 暂时无法接收信息，则停止读取 source 。

• final: Do not send the message to any further destination.

• fallback: Process messages that were not processed by other log paths.

• catchall: Process every message, regardless of its source.

• flow-control: Stop reading messages from the source if the destination cannot accept them. See .

For details on the individual flags, see . The effect and use of the flow-control flag is detailed in .

	Note
	Note that a message goes to every matching destination by default. To change this behavior, use the final flag. See for details.