<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-2">
<META content="MSHTML 6.00.2900.3059" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>Hi
all,</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=109492409-28032007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>I'm trying to set up
a syslog-ng 2.0.0 on Red Hat Enterprise 4.0 i386 edition.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>I have already set
up my /etc/syslog-ng.conf file in following way:</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=109492409-28032007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>[root@swlogg02
cisco]# cat /etc/syslog-ng.conf<BR># syslog-ng configuration file.<BR>#<BR>#
This should behave pretty much like the original syslog on RedHat. But<BR># it
could be configured a lot smarter.<BR>#<BR># See syslog-ng(8) and
syslog-ng.conf(5) for more information.<BR>#</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>options
{<BR> sync
(0);<BR> time_reopen
(10);<BR> log_fifo_size
(1000);<BR> long_hostnames
(off);<BR> use_dns
(no);<BR> use_fqdn
(no);<BR> create_dirs
(yes);<BR> keep_hostname
(yes);<BR>};</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>source s_cisco
{<BR> udp(ip(0.0.0.0)
port(514));<BR>};</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>destination
d_cisco_d { file("/var/log/cisco/$HOST/$YEAR/$MONTH/$DAY/log");
};<BR>destination d_cisco_c {
file("/var/log/cisco/$HOST/$YEAR/$MONTH/$DAY/log"); };</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>filter
f_cisco_d { level(debug); };<BR>filter f_cisco_c {
level(crit); };</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>log {
source(s_cisco); filter(f_cisco_d); destination(d_cisco_d); };<BR>log {
source(s_cisco); filter(f_cisco_c); destination(d_cisco_c);
};<BR></SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=109492409-28032007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN
class=109492409-28032007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>but I only got logs
from only one machine, for your information from ASA5520. I would liek to
receive messages from almost 50 machines (routers/switches/firewalls, etc). As
general I set up on firewalls critical level of logging and on router/switches
debug.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=109492409-28032007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=109492409-28032007>Could you please
tell me what I did wrong?</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=109492409-28032007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN
class=109492409-28032007> </DIV></SPAN></FONT>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV align=left><FONT face=Arial size=2><SPAN
class=109492409-28032007>regards</SPAN></FONT></DIV>
<DIV align=left><FONT face=Arial size=2></FONT> </DIV>
<DIV align=left><FONT face=Arial size=2>-- </FONT></DIV>
<DIV align=left><FONT face=Arial size=2><STRONG>Michał
Rębelski</STRONG></FONT></DIV></BODY></HTML>