<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Martin Holste wrote:
<blockquote
cite="mid:h2odf9074861004010639kb5d78acbqf5fb4561da5445d0@mail.gmail.com"
type="cite">Please step in and correct me if I'm wrong here, but
according to Marci's blog post at <a moz-do-not-send="true"
href="http://marci.blogs.balabit.com/2009/05/tag-support-in-syslog-ng.html">http://marci.blogs.balabit.com/2009/05/tag-support-in-syslog-ng.html</a>
it would appear that this is possible using different syntax. Namely,
using <span style="font-family: courier new;">tags(".source.log2")</span>
in your filter.<br>
</blockquote>
No, you are using a wrong tag name.<br>
In this case, you can use the following tag:<br>
tags(".source.s_app")<br>
<br>
this is an on-the-fly generated tag,every incoming message has it one
given with the following formula: ".source.<sourcename>"
<blockquote
cite="mid:h2odf9074861004010639kb5d78acbqf5fb4561da5445d0@mail.gmail.com"
type="cite"><br>
<div class="gmail_quote">On Wed, Mar 31, 2010 at 12:57 PM, Zoltán
Pallagi <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:pzolee@balabit.hu">pzolee@balabit.hu</a>></span> wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">Hi,<br>
<br>
I'm afraid that you may misunderstand the working of this feature. The
tag field exists only within a running syslog-ng and just a virtual
part of the message. The sent message doesn't contain tag fields that's
why you cannot filter these tags with another syslog-ng.<br>
<br>
However, I can suggest you an other solution:<br>
use the program_override option. This will override the $PROGRAM macro
with the specified value.<br>
For example:<br>
<span><font face="Arial" size="2">source
s_app {<br>
file("/var/log/log1.log" program_override("</font></span><span><font
face="Arial" size="2">/var/log/log1.log"</font></span><span><font
face="Arial" size="2">));<br>
file("/opt//log/log2.log" tags("log2") </font></span><span><font
face="Arial" size="2">program_override("</font></span><span><font
face="Arial" size="2">/opt/log/log2.log"</font></span><span><font
face="Arial" size="2">)</font></span><span><font face="Arial" size="2">);<br>
file("/opt/log/log3.log" tags("log3") </font></span><span><font
face="Arial" size="2">program_override("</font></span><span><font
face="Arial" size="2">/opt/log/log3.log"</font></span><span><font
face="Arial" size="2">)</font></span><span><font face="Arial" size="2">);<br>
};</font></span><br>
<br>
After that, you can use a specified program filter on the central
logging server side to separate them.<br>
<br>
2010.03.31. 16:39 keltezéssel, Hoenig, Stefan, VF-Group írta:
<blockquote type="cite">
<div>
<div class="h5">
<div><span><font face="Arial" size="2">Hi
all,</font></span></div>
<div><span><font face="Arial" size="2">I
got a problem to get the "tags" feature working on our syslog-ng 3.1. I
want to collect messages from 3 different files on the</font></span></div>
<div><span><font face="Arial" size="2">source
system and want to separate them again on the central logging server.</font></span></div>
<div><span><font face="Arial" size="2">The
client configuration looks like this:</font></span></div>
<div><span><font face="Arial" size="2">----------------------------------------------------------------------------------------------------</font></span></div>
<div><span><font face="Arial" size="2">source
s_app {<br>
file("/var/log/log1.log");<br>
file("/opt//log/log2.log" tags("log2"));<br>
file("/opt/log/log3.log" tags("log3"));<br>
};</font></span></div>
<div><span><font face="Arial" size="2">options
{<br>
};</font></span><span><br>
<font face="Arial"><font size="2"><br>
destination d_app { tcp("<a moz-do-not-send="true"
href="http://logrelay01.domain.com" target="_blank">logrelay01.domain.com</a>"
port(13074)); };<br>
<br>
log {<br>
source(s_app);<br>
destination(d_app);<br>
};<br>
<span>----------------------------------------------------------------------------------------------------</span></font></font></span></div>
<div><span></span> </div>
<div><span><font face="Arial" size="2">The
log relay does nothing than forward the messages to the central logging
server with the following config:</font></span></div>
<div><span><span><font face="Arial" size="2">----------------------------------------------------------------------------------------------------</font></span></span></div>
<div><span><span><font face="Arial" size="2">options {<br>
time_sleep(20);<br>
log_fifo_size(1000);<br>
dns_cache(2000);<br>
dns_cache_expire(87600);<br>
keep_hostname(yes);<br>
};</font></span></span></div>
<div><span><span><font face="Arial" size="2"><br>
source s_remote { tcp(ip("0.0.0.0") port(13074)); };</font></span></span></div>
<div> </div>
<div><span><span><font face="Arial" size="2">destination
remote_tcp {
tcp("<a moz-do-not-send="true" href="http://centrallog01.domain.com"
target="_blank">centrallog01.domain.com</a>" port(13074)); };</font></span></span></div>
<div><span><span></span></span><span><span> </span></span></div>
<div><font face="Arial" size="2">log {<br>
source(s_<span>remote</span>);<br>
destination(<span>remote</span>_tcp);<br>
};<br>
<span><span><font face="Arial" size="2">----------------------------------------------------------------------------------------------------</font></span></span></font></div>
<div><font face="Arial" size="2"><span><span></span></span></font> </div>
<div><font face="Arial" size="2"><span><span>On the central
logging server I use filters
to separate the logfiles again:</span></span></font></div>
<div><font face="Arial" size="2"><span><span><span><span><font
face="Arial" size="2">----------------------------------------------------------------------------------------------------</font></span></span></span></span></font></div>
<div><font face="Arial" size="2"><span><span><span><span>@version:
3.0<br>
</span></span></span></span></font><font face="Arial" size="2"><span><span><span><span></span></span></span></span></font></div>
<div><font face="Arial" size="2"><span><span><span><span>include
"/opt/config/syslogng-inc.conf";</span></span></span></span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span><span><span><span>options {<br>
time_sleep(20);<br>
dns_cache(2000);<br>
dns_cache_expire(87600);<br>
keep_hostname(yes);<br>
create_dirs(yes);<br>
};</span></span></span></span></font></div>
<div><span><span><span><span><font face="Arial" size="2"><br>
source s_<span>remote</span> { tcp
(ip("0.0.0.0") port(13074) keep-alive(yes)); };<br>
</font></span></span></span></span></div>
<div><font face="Arial" size="2"><span><span><span><span>============================================</span></span></span></span></font></div>
<div><font face="Arial" size="2"><span><span><span><span></span></span></span></span></font> </div>
<div><font face="Arial" size="2"><span><span><span><span>This is
the confoguration in
/opt/config/syslogng-inc.conf</span></span></span></span></font></div>
<div><font face="Arial" size="2"><span><span><span><span># Filter<br>
filter f_log1 { host("web00(09|10)"); };<br>
filter f_log2 { host("web00(09|10)") and tags("log2"); };<br>
filter f_log3 { host("web00(09|10)") and tags("log3"); };</span></span></span></span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span><span><span><span>#Configuration
for Destinations</span></span></span></span></font></div>
<div><font face="Arial" size="2"><span><span><span><span>destination
d_log1 {
file("/var/logs/log1/combined.log" perm(0755) dir_perm(0755)); };<br>
destination d_log2 { file("/var/logs/log2/combined.log" perm(0755)
dir_perm(0755)); };<br>
destination d_log3 { file("/var/logs/log3/combined.log" perm(0755)
dir_perm(0755)); };<br>
</span></span></span></span></font></div>
<div><font face="Arial" size="2"><span><span><span><span>#
Logfile log1<br>
log {<br>
source(s_remote);<br>
filter(f_log1);<br>
destination(d_log1);<br>
};</span></span></span></span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span><span><span><span>#
Logfile log2<br>
log {<br>
source(s_remote);<br>
filter(f_log2);<br>
destination(d_log2);<br>
};</span></span></span></span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span><span><span><span>#
Logfile log3</span></span></span></span></font></div>
<div><font face="Arial" size="2"><span><span><span><span>log {<br>
source(s_remote);<br>
filter(f_log3);<br>
destination(d_log3);<br>
};</span></span></span></span></font></div>
<div><span><span><span><span><font face="Arial" size="2">----------------------------------------------------------------------------------------------------</font></span></span></span></span></div>
<div><span><span><span><span></span></span></span></span> </div>
<div><span><span><span><span><font face="Arial" size="2">Does
anybody have an idea, why it does not work
as expected.</font></span></span></span></span></div>
<div><span><span><span><span></span></span></span></span> </div>
<div><span><span><span><span><font face="Arial" size="2">Thanks
for any suggestion and/or idea.</font></span></span></span></span></div>
<div><span><span><span><span></span></span></span></span> </div>
<div><span><span><span><span><font face="Arial" size="2">Best
regards Stefan</font></span></span></span></span></div>
<div><span><span><span><span></span></span></span></span> </div>
</div>
</div>
<pre><fieldset></fieldset>
______________________________________________________________________________
Member info: <a moz-do-not-send="true"
href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a moz-do-not-send="true"
href="http://www.balabit.com/support/documentation/?product=syslog-ng"
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a moz-do-not-send="true"
href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
<font color="#888888"><br>
<div>-- <br>
pzolee</div>
</font></div>
<br>
______________________________________________________________________________<br>
Member info: <a moz-do-not-send="true"
href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"
target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a moz-do-not-send="true"
href="http://www.balabit.com/support/documentation/?product=syslog-ng"
target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a moz-do-not-send="true"
href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
<br>
</blockquote>
</div>
<br>
<pre wrap="">
<hr size="4" width="90%">
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
pzolee
</pre>
</body>
</html>