<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
Greetings;<br><br>I currently have syslog-ng.conf set up to place data into logs in the following way:<br><br>/var/log/MyHosts/SambaServers/$FULLHOST.log<br><br>When the logs are created, they are placed under:<br><br>/var/log/MyHosts/SambaServers/samba-1.mynet.org/samba-1.mynet.org.log<br><br>The contents for the hostname field in logs from samba-1 look like this:<br><br>May 13 10:32:55 samba-1.mynet.org/samba-1.mynet.org<br><br>Because of the double entry in syslog, all looks fine and logs are stored in nice neat folders named after the host that sent them, great.<br><br>I have however a few MS Wintel servers that I am using Snare for sending syslog data to, and their logs look like:<br><br>May 13 10:36:15 samba-2.mynet.org MSWinEventLog 1 Security<br><br>As you can see, the logs from this host do not contain the hostname twice, therefore logs for this host are stored as:<br><br>/var/log/MyHosts/SambaServers/samba-2.mynet.org.log<br><br>I can create a rule like /var/log/MyHosts/SambaServers/$FULLHOST/$FULLHOST.log for just these hosts, but that will not solve my problem long term, especially as I am considering implementing Snare site-wide.<br><br>Could someone please advise as to whether there is an easy fix for this, or should I cease using Snare?<br><br>Thanks in advance,<br><br>.vp<br><br><br></body>
</html>