<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
<br>
Paras Fadte írta:
<blockquote
cite="mid:75cf5800911082129v43cc5769uf63be6ec9f805f91@mail.gmail.com"
type="cite">
<pre wrap="">Hi Bill,
Thanks for the response . When I tried the following it didn't seem to
work. The remote host doesn't show any logs .
source postgreslog {file("/home/postgres/data_log-8_4_1"); };
destination postgresloghost { udp("192.168.1.8" port(5140)); };
log { source(postgreslog); destination(postgresloghost); };
</pre>
</blockquote>
Are you really sure that your psql logs come from
"/home/postgres/data_log-8_4_1"?<br>
You can run syslog-ng with "-Fevd" options to watch what syslog-ng
reads from this file (to check this just send a plain text line to this
file and you should see it on the screen of syslog-ng)<br>
<blockquote
cite="mid:75cf5800911082129v43cc5769uf63be6ec9f805f91@mail.gmail.com"
type="cite">
<pre wrap="">
But the following works :
filter f_postgres { facility(local0) and match('postgres'); };
destination postgresloghost { udp("192.168.1.8" port(5140)); };
log { source(src); filter(f_postgres); destination(postgresloghost);
flags(final); };
</pre>
</blockquote>
Can you show me your full source src{...} line in config? Because your
psql logs seem to be coming from /dev/log<br>
<blockquote
cite="mid:75cf5800911082129v43cc5769uf63be6ec9f805f91@mail.gmail.com"
type="cite">
<pre wrap="">
What could be wrong ? I have also noticed that the remote syslog
server logs these messages in its /var/log/messages file also . Can
this be prevented ?
</pre>
</blockquote>
Yes because your sources also should be splitted to different
destinations.<br>
For example:<br>
source s_net {udp(port(5140));};<br>
destination psql_file{file("/var/log/psql.log");};<br>
log {source(s_net);destination(psql_file);};<br>
<blockquote
cite="mid:75cf5800911082129v43cc5769uf63be6ec9f805f91@mail.gmail.com"
type="cite">
<pre wrap="">
Thank you
-Paras
On Thu, Nov 5, 2009 at 9:12 PM, Bill Nash <a class="moz-txt-link-rfc2396E" href="mailto:billn@billn.net"><billn@billn.net></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Sure, it's very easy. Create a source stanza for the files you want to
monitor. Create a destination stanza for the host you want to send to. Add
another log stanza containing them both.
source mysqllog { file("/var/lib/mysql/mysql.err" log_prefix("mysql: "); };
destination mysqlloghost { udp("192.168.1.1" port (514)); };
log{ source(mysqllog); destination(mysqlloghost); };
- billn
On Thu, Nov 5, 2009 at 2:00 AM, Paras Fadte <a class="moz-txt-link-rfc2396E" href="mailto:plfgoa@gmail.com"><plfgoa@gmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi,
Is it possible to log only a particular logs to a remote syslog server
? For example logging only mysql/postgres logs to a remote host .
syslog-ng version used is syslog-ng 1.6.8
Thank you.
-Paras
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation:
<a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<pre wrap="">
--
- billn
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation:
<a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<pre wrap=""><!---->______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
</body>
</html>