<HTML>
<HEAD>
<TITLE>Rewrite facility names of remote logs</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>I’ve setup Syslog-NG to receive logs from other servers which have been configured as follows - <BR>
Tomcat servers are forwarding logs as facility6 to rsyslog, which then forwards to central log server. <BR>
Apache servers are forwarding logs as faility5 to rsyslog which then forwards to central log server. <BR>
<BR>
When I receive these logs on the central log server, they are written to files as their facility name, i.e. local6.$DAY. <BR>
Is there a way to change or re-write the facility name on the fly so that instead of local6.$DAY I can get the file written as tomcat.$DAY?<BR>
<BR>
Here is the configuration I’m using to store the logs - <BR>
<BR>
destination d_net {<BR>
file("/var/log/hosts/$YEAR/$MONTH/$HOST/$FACILITY.$DAY"<BR>
owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)<BR>
);<BR>
};<BR>
<BR>
log {<BR>
source(s_net);<BR>
destination(d_net);<BR>
};<BR>
</SPAN></FONT>
</BODY>
</HTML>