Events destined for Python processing are configured through a log ID that references a Python policy. The selection of the events are performed via a filter associated with this log ID. The remainder of the events destined for the same syslog server can bypass Python processing by redirecting them to a different log ID. The following example clarifies this point:
In the example above, the configuration-only event 2012 from application "nat" is sent to log-id 33. All other events are forwarded to the same syslog destination via log-id 34, without any modification. As a result, all events (modified via log-id 33 and unmodified via log-id 34) are sent to the syslog 1 destination.
This configuration may cause reordering of syslog messages at the syslog 1 destination because of slight delay of messages processed by Python.