set up your source:<br>
source src { unix-stream("/dev/log"); internal(); udp(ip(<a href="http://0.0.0.0">0.0.0.0</a>) port (514)); };<br>
<br>
set up a simple filter:<br>
filter f_syslog { not facility(auth, authpriv) and not facility(mail) ; };<br>
<br>
and set up the destination file be a new file for each new host:<br>
destination syslog { file("/var/log/HOSTS/$HOST"); };<br>
<br>
and don't forget the log statement:<br>
log { source(src); filter(f_syslog); destination(syslog); };<br>
<br>
<br>
chris<br>
<br><br><div><span class="gmail_quote">On 9/7/05, <b class="gmail_sendername">Joost greene</b> <<a href="mailto:joost.greene@gmail.com">joost.greene@gmail.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hello,<br>
<br>
I have different sets of devices, dslams, nas, core routers, customer routers,...<br>
<br>
i want to syslog them all, i want to make each device log to a file
separately to ease it up for NOC, someone suggested syslog-ng, frankly,
i got quickly lost in its docs, the syntax isnt clear, how can i just
easily specify to let it log per source into different files ?<br>
<br>
Regards,<br><span class="sg">
Joost<br>
</span><br>_______________________________________________<br>syslog-ng maillist - <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a onclick="return top.js.OpenExtLink(window,event,this)" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html
</a><br><br><br><br></blockquote></div><br>