I have made that changes and restarted syslog services even though its not working///<br>Now its like this<br><br>options { <br> long_hostnames(off); <br> sync(0); <br> perm(0640); <br>
stats(3600); <br> keep_hostname(yes);<br>};<br>source s_external {<br> udp(port(514));<br> #udp(ip("192.168.114.129") port(514));<br> #udp(ip("0.0.0.0") port(514));<br>
}; # Specific<br>source s_stunnel {<br> tcp(ip("127.0.0.1")<br> port(514)<br> max-connections(1));<br> };<br>destination d_external { file("/data/extract/syslogs/$HOST_syslog.log" \<br>
owner(cubot) group(users) perm(0600) dir_perm(0700) create_dirs(yes)<br> template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE \n") );<br> };<br><br>destination d_stunnel{ file("/data/extract/syslogs/$HOST/$HOST_syslog.log" \<br>
owner(cubot) group(users) perm(0600) dir_perm(0700) create_dirs(yes)<br> template("$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE \n") );<br> };<br><br>log { source(s_external); destination(d_external); };<br>
log { source(s_stunnel); destination(d_stunnel); };<br><br><br><br><div class="gmail_quote">On Tue, Apr 20, 2010 at 1:55 PM, Alan McKinnon <span dir="ltr"><<a href="mailto:Alan.McKinnon@is.co.za">Alan.McKinnon@is.co.za</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="im">On Tuesday 20 April 2010 08:38:51 abhay singh wrote:<br>
> Hi All,<br>
><br>
> I have made changes in syslog-ng.conf to redirect logs coming from other<br>
> server to some specified log file and in some format<br>
><br>
> source s_external {<br>
> udp(port(514));<br>
> };<br>
> source s_stunnel {<br>
> tcp(ip(127.0.0.1) port(514));<br>
> };<br>
><br>
> destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \<br>
> owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes));<br>
> };<br>
><br>
> destination s_stunnel { file("/mydir/syslogs/$HOST/syslog.log" \<br>
> owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes));<br>
> };<br>
><br>
> log { source(s_external); destination(s_external); };<br>
> log { source(s_stunnel); destination(s_stunnel); };<br>
><br>
> But my log file is being created with name "syslog.log" and not as<br>
> "<hostnmae/ip>_syslog.log" neither $HOST directory made, what may be the<br>
> issue?<br>
><br>
> Globle options are<br>
><br>
> option{<br>
><br>
> long_hostname(off);<br>
> sync(0);<br>
> }<br>
<br>
<br>
</div>Your sources and destinations have the same name. That is not allowed.<br>
<br>
Rename the destinations to d_<something><br>
<br>
--<br>
Alan McKinnon<br>
Systems Engineer^W Technician<br>
Infrastructure Services<br>
Internet Solutions<br>
<br>
+27 11 575 7585<br>
<br>
Please note: This email and its content are subject to the disclaimer as displayed at the following link <a href="http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm" target="_blank">http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm</a>. Should you not have Web access, send a mail to <a href="mailto:disclaimers@is.co.za">disclaimers@is.co.za</a> and a copy will be emailed to you.<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</blockquote></div><br><br clear="all"><br>-- <br>Regards..<br>Abhay Singh..<br>91-98804-55587<br>Sr. Software Engineer.<br>Robust Designs India Pvt Ltd.<br>Bangalore<br>