<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>Load balancing using $SEC</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>Hi,<BR>
<BR>
I'm trying to do some kind of load-balancing using syslog-ng. I'm willing to write to 2 different files named "syslog1" and "syslog2". The first one would get all messages received by syslog whose timestamp have a second ending with 0, 1, 2, 3 or 4. Syslog 2 would get all messages whose second ends with 5, 6, 7, 8 or 9.<BR>
<BR>
For instance, if I get those messages :<BR>
Feb 27 00:00:03 blabla1<BR>
Feb 27 00:00:04 blabla2<BR>
Feb 27 00:00:05 blabla3<BR>
Feb 27 00:00:06 blabla4<BR>
<BR>
The first two messages would end up in syslog1 and the last 2 messages would end up in syslog2<BR>
<BR>
However, I was not able to do this because :<BR>
* filtering is not possible on any date-related macro (I don't know why, but only MSG and MSGHDR macros seem populated at that point in time)<BR>
* I can't apply a rewrite rule on $SEC<BR>
* I can't apply any function to the $SEC macro in the destination statement, or I don't know how to do it<BR>
<BR>
Do you think it's still possible to achieve what I want with syslog-ng ?<BR>
<BR>
Vincent</FONT>
</P>
</BODY>
</HTML>