Re: Problem using syslog !!prog syntax

Thanks for the response.  When we consider the non-!!prog use case, having multiple *.* matches isn't a problem.  It is only within the !!prog block that there is 1 match then done.  Reading the man page:

                !!prog causes the subsequent block to abort evaluation when a message

                matches, ensuring that only a single **set of actions** is taken.

                (emphasis mine)

The way I read this is, that any and all actions within the block will be evaluated and taken upon a match.  Perhaps that is not what was indended and/or I my reading of the man page is wrong.

Assuming I am not wrong in my interpertation of the intent, I have submitted this(https://marc.info/?l=openbsd-bugs&m=176807926301784&w=2) bug report with a possible fix.  

Cheers

Sent from my Galaxy

-------- Original message --------

From: olp_76@yahoo.ca

Date: 1/12/26 10:29 PM (GMT-06:00)

To: Michael Graves <mgraves@brainfat.net>, Simen Stavdal <sstavdal@gmail.com>

Cc: misc@openbsd.org

Subject: Re: Problem using syslog !!prog syntax

!!prog causes subsequent block to abort evaluation when a message matches.

*.* means match everything. You have two of those statements. But first one will always match. Next one should not be evaluated as per !!prog logic then.
I think you proved that this is the case when you changed order of your statements.Right?

On Saturday, January 10, 2026 at 06:48:26 PM GMT+9, Simen Stavdal <sstavdal@gmail.com> wrote:

Hi Michael,

From what I can see in the man pages, it should log to both.

Example from the man page :

# Everybody gets emergency messages, plus log them on another
# machine.
*.emerg *
*.emerg @arpa.berkeley.edu

This, however, is outside the !! (per daemon logs).

As a test, would it work if you set up logging to two destinations "globally", i.e outside the logging rules for the particular daemon?

/s

On Sun, 4 Jan 2026 at 00:14, Michael Graves <mgraves@brainfat.net> wrote:

I am trying to use the syslog !!prog syntax and am running into
problems, before I go to far down the rabbit hole of trying to identify
a bug, I would like to make sure that my expectations are sane.  I am
try to use syslog.conf with the following syntax

    !!relayd
    *.*     /var/log/relayd
    *.*     tls4://logginghost:8513
    !*
    <rest of standard syslog.conf>

When relayd generates a log it only is written to the /var/log/relayd
file.  If I switch the order, then the log will only be written to
loginghost.

My expectation would be that both destinations would have the log
written.  Am I misunderstanding the man page?

Thanks for any insight or corrections.