cheusov@tut.by (Aleksey Cheusov) writes:

>I think the following scheme

>func do_syslog (line)
>{
>   if (match1(line)){
>      action1(line)
>   }elif if (match2(line)){
>      action2(line)
>   }elif ...
>   ...
>}

>scheme is a reasonable alternative.

This just drops a valuable feature: logging events to
multiple destinations independently.

The thing that you cannot do with syslog now is to
log only low priority events but skip high priority
events. I.e.:

user.info	only-info.log

will result in only-info.log to get all events with
priority info or higher.

With your scheme you could do

user.notice	/dev/null
user.info	only-info.log

and divert the higher priority events to /dev/null
(or some other log file).

A better way of doing things is to distinguish these
events not by priority but by facility. But sometimes
you have no control over this.

Of course you could also use sysutils/syslog-ng which
has a rich set of filters.

-- 
-- 
                                Michael van Elst
Internet: mlelstv@serpens.de
                                "A potential Snark may lurk in every tree."