In that case, put !relayd at the top of syslog.conf and drop !* to stop any further processing of relayd related messages. On Friday, January 16, 2026 at 03:52:28 AM GMT+9, Michael Graves <[email protected]> wrote: That almost solves the problem. If a message comes in and matches the !prog it will log, but if it also matches another line in the syslog.conf file, it will log to that destination too. That is not a huge deal, but can cause duplicate messages. Thanks for the confirmation.
Sent from my Galaxy -------- Original message --------From: [email protected] Date: 1/14/26 7:54 PM (GMT-06:00) To: Simen Stavdal <[email protected]>, Michael Graves <[email protected]> Cc: [email protected] Subject: Re: Problem using syslog !!prog syntax as per man page !!prog seems to be using,"either OR" logic and !prog "AND" So I think you need !prog not !!prog Both will stop evaluation of any subsequent blocks. So we do need to add !* after !prog also. !relayd *.* /var/log/relayd *.* tls4://logginghost:8513 !* On Tuesday, January 13, 2026 at 11:45:31 PM GMT+9, All <[email protected]> wrote: I agree, perhaps the wording could be more precise. Although, one can argue that specifying *several selectors* in order to log this and not that can be considered a "set" of actions. Not sure if you really want !!prog for your use case. !prog should suffice, as in: !relayd *.* /var/log/relayd *.* tls4://logginghost:8513 On Tuesday, January 13, 2026 at 10:43:03 PM GMT+9, Michael Graves <[email protected]> wrote: Thanks for the response. When we consider the non-!!prog use case, having multiple *.* matches isn't a problem. It is only within the !!prog block that there is 1 match then done. Reading the man page: !!prog causes the subsequent block to abort evaluation when a message matches, ensuring that only a single **set of actions** is taken. (emphasis mine) The way I read this is, that any and all actions within the block will be evaluated and taken upon a match. Perhaps that is not what was indended and/or I my reading of the man page is wrong. Assuming I am not wrong in my interpertation of the intent, I have submitted this(https://marc.info/?l=openbsd-bugs&m=176807926301784&w=2) bug report with a possible fix. Cheers Sent from my Galaxy -------- Original message -------- From: [email protected] Date: 1/12/26 10:29 PM (GMT-06:00) To: Michael Graves <[email protected]>, Simen Stavdal <[email protected]> Cc: [email protected] Subject: Re: Problem using syslog !!prog syntax !!prog causes subsequent block to abort evaluation when a message matches. *.* means match everything. You have two of those statements. But first one will always match. Next one should not be evaluated as per !!prog logic then. I think you proved that this is the case when you changed order of your statements.Right? On Saturday, January 10, 2026 at 06:48:26 PM GMT+9, Simen Stavdal <[email protected]> wrote: Hi Michael, >From what I can see in the man pages, it should log to both. Example from the man page : # Everybody gets emergency messages, plus log them on another # machine. *.emerg * *.emerg @arpa.berkeley.edu This, however, is outside the !! (per daemon logs). As a test, would it work if you set up logging to two destinations "globally", i.e outside the logging rules for the particular daemon? /s On Sun, 4 Jan 2026 at 00:14, Michael Graves <[email protected]> wrote: > I am trying to use the syslog !!prog syntax and am running into > problems, before I go to far down the rabbit hole of trying to identify > a bug, I would like to make sure that my expectations are sane. I am > try to use syslog.conf with the following syntax > > !!relayd > *.* /var/log/relayd > *.* tls4://logginghost:8513 > !* > <rest of standard syslog.conf> > > When relayd generates a log it only is written to the /var/log/relayd > file. If I switch the order, then the log will only be written to > loginghost. > > My expectation would be that both destinations would have the log > written. Am I misunderstanding the man page? > > Thanks for any insight or corrections. >
