Re: Problem using syslog !!prog syntax

as per man page !!prog seems to be using,"either OR" logic and !prog "AND"

So I think you need !prog not !!prog

Both will stop evaluation of any subsequent blocks. So we do need to add !* after !prog also.

!relayd
*.* /var/log/relayd
*.* tls4://logginghost:8513
!*

On Tuesday, January 13, 2026 at 11:45:31 PM GMT+9, All <olp_76@yahoo.ca> wrote:

I agree, perhaps the wording could be more precise. Although, one can argue that specifying *several selectors* 
in order to log this and not that can be considered a "set" of actions.
Not sure if you really want !!prog for your use case.

!prog should suffice, as in:

!relayd
*.*     /var/log/relayd
*.*     tls4://logginghost:8513

On Tuesday, January 13, 2026 at 10:43:03 PM GMT+9, Michael Graves <mgraves@brainfat.net> wrote:





Thanks for the response.  When we consider the non-!!prog use case, having multiple *.* matches isn't a problem.  It is only within the !!prog block that there is 1 match then done.  Reading the man page:

                !!prog causes the subsequent block to abort evaluation when a message
                matches, ensuring that only a single **set of actions** is taken.
                (emphasis mine)

The way I read this is, that any and all actions within the block will be evaluated and taken upon a match.  Perhaps that is not what was indended and/or I my reading of the man page is wrong.

Assuming I am not wrong in my interpertation of the intent, I have submitted this(https://marc.info/?l=openbsd-bugs&m=176807926301784&w=2) bug report with a possible fix.  

Cheers

Sent from my Galaxy


-------- Original message --------
From: olp_76@yahoo.ca
Date: 1/12/26 10:29 PM (GMT-06:00)
To: Michael Graves <mgraves@brainfat.net>, Simen Stavdal <sstavdal@gmail.com>
Cc: misc@openbsd.org
Subject: Re: Problem using syslog !!prog syntax

!!prog causes subsequent block to abort evaluation when a message matches.

*.* means match everything. You have two of those statements. But first one will always match. Next one should not be evaluated as per !!prog logic then.
I think you proved that this is the case when you changed order of your statements.Right?




On Saturday, January 10, 2026 at 06:48:26 PM GMT+9, Simen Stavdal <sstavdal@gmail.com> wrote:





Hi Michael,

From what I can see in the man pages, it should log to both.
Example from the man page :

# Everybody gets emergency messages, plus log them on another
# machine.
*.emerg *
*.emerg @arpa.berkeley.edu

This, however, is outside the !! (per daemon logs).
As a test, would it work if you set up logging to two destinations "globally", i.e outside the logging rules for the particular daemon?

/s


On Sun, 4 Jan 2026 at 00:14, Michael Graves <mgraves@brainfat.net> wrote:
> I am trying to use the syslog !!prog syntax and am running into
> problems, before I go to far down the rabbit hole of trying to identify
> a bug, I would like to make sure that my expectations are sane.  I am
> try to use syslog.conf with the following syntax
>
>     !!relayd
>     *.*     /var/log/relayd
>     *.*     tls4://logginghost:8513
>     !*
>     <rest of standard syslog.conf>
>
> When relayd generates a log it only is written to the /var/log/relayd
> file.  If I switch the order, then the log will only be written to
> loginghost.
>
> My expectation would be that both destinations would have the log
> written.  Am I misunderstanding the man page?
>
> Thanks for any insight or corrections.
>