<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
Thank you Evan, does hostname chaining also force multiple logging? If now, does anyone know why I am logging my data to two locations instead of just one?<br><br>By the way, any good references to writing a good .conf file for this would be greatly appreciated.<br><br>Thanks again.<br><br>.vp<br><br>> Date: Thu, 17 Jan 2008 14:26:43 -0800<br>> From: erempel@uvic.ca<br>> To: syslog-ng@lists.balabit.hu<br>> Subject: Re: [syslog-ng] Hosts Logging Into Multiple Destinations (files) Bad Filter???<br>> <br>> You have hostname chaining enabled. In this case, the $FULLHOST macro expands to $HOST/$HOST for most<br>> directly logging hosts (no other relay syslogs).<br>> <br>> Try using a $FULLHOST_FROM or $HOST<br>> <br>> Evan Rempel<br>> <br>> wiskbroom@hotmail.com wrote:<br>> > Hello;<br>> > <br>> > I thought that I had all of my hosts setup to log into /var/log/ABCcorp/$FULLHOST/$FULLHOST.log by default if not already defined by another filter, but I am seeing that they log to multiple destinations instead.<br>> > <br>> > For instance, I have a host named linksys-1000, logs for this host get sent into:<br>> > <br>> > /var/log/ABCcorp/accesspoints/linksys-1000/linksys-1000.log<br>> > <br>> > as well as <br>> > <br>> > /var/log/ABCcorp/linksys-1000/linksys-1000.log<br>> > <br>> > Also, I do not understand how /var/log/ABCcorp/$FULLHOST/$FULLHOST.log gets created and used in the first place, there is no filter setup like this.<br>> > <br>> > <br>> > Thanks all,<br>> > <br>> > .vp<br>> > <br>> > <br>> > Here is a sample of my config file:<br>> > <br>> > ###########<br>> > # Destinations #<br>> > ##########<br>> > <br>> > destination D_switch { file("/var/log/ABCcorp/switches/$FULLHOST.log"<br>> > perm(0644)); };<br>> > destination D_edge { file("/var/log/ABCcorp/edge_devices/$FULLHOST.log" perm(0644)); };<br>> > destination D_firewall { file("/var/log/ABCcorp/firewalls/$FULLHOST.log" perm(0644)); };<br>> > destination D_router { file("/var/log/ABCcorp/routers/$FULLHOST.log"<br>> > perm(0644)); };<br>> > destination D_accesspoints { file("/var/log/ABCcorp/accesspoints/$FULLHOST.log"<br>> > perm(0644)); };<br>> > destination D_udp { file("/var/log/ABCcorp/$FULLHOST.log"<br>> > perm(0644)); };<br>> > <br>> > destination D_hosts { file("/var/log/ABCcorp/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$DAY"<br>> > owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); };<br>> > <br>> > #######<br>> > # Filters #<br>> > #######<br>> > <br>> > destination D_db_discard { file("/var/log/discard.log"); };<br>> > <br>> > <br>> > destination D_db_mysql {<br>> > pipe("/var/log/mysql.pipe"<br>> > template("INSERT INTO logs<br>> > (host, facility, priority, level, tag, datetime, program, msg)<br>> > VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC',<br>> > '$PROGRAM', '$MSG' );\n") template-escape(yes));<br>> > <br>> > <br>> > filter F_edge { host("edge*") or host("192.116.*"); };<br>> > filter F_router { host("gw*") or host("rtr") or host("router"); };<br>> > filter F_switch { host("sw*") or host("sw1") or host("sw2"); };<br>> > filter F_firewall { host("^fw*"); };<br>> > filter F_accesspoints { host("^linksys*"); };<br>> > filter F_InternetIP { host("192.116.19.*"); };<br>> > <br>> > #######<br>> > # Logs #<br>> > #######<br>> > <br>> > log { source(S_udp); filter(F_switch); destination(D_switch); };<br>> > log { source(S_udp); filter(F_router); destination(D_router); };<br>> > log { source(S_udp); filter(F_edge); destination(D_edge); };<br>> > log { source(S_udp); filter(F_firewall); destination(D_firewall); };<br>> > log { source(S_udp); filter(F_accesspoints); destination(D_accesspoints); };<br>> > <br>> > <br>> > log { source(S_udp); destination(D_udp);};<br>> > log { source(S_udp); destination(D_db_mysql); };<br>> > <br>> > <br>> > <br>> > <br>> > <br>> > <br>> > <br>> > ------------------------------------------------------------------------<br>> > <br>> > _______________________________________________<br>> > syslog-ng maillist - syslog-ng@lists.balabit.hu<br>> > https://lists.balabit.hu/mailman/listinfo/syslog-ng<br>> > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html<br>> > <br>> <br>> _______________________________________________<br>> syslog-ng maillist - syslog-ng@lists.balabit.hu<br>> https://lists.balabit.hu/mailman/listinfo/syslog-ng<br>> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html<br>> <br></body>
</html>