<html><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:12pt"><div><span>Hi,</span></div><div><span><br></span></div><div><span>I have a problem to manage the Syslog-NG messages sending from different Syslog-NG clients at different remote sites.</span></div><div><span><br></span></div><div>For example, I have 10 sites (site1, site2, site3 to site 10) running Syslog-NG clients. Each site has one Syslog-NG server and all the Syslog messages will be forwarded to the centralized Syslog-NG server and insert into the MySQL database at the headquarter finally.</div><div><br></div><div>Now, I can see all the Syslog messages at the headquarter MySQL database; but it is hard for me to manage them.</div><div><br></div><div>For example, if I know the hostname of a particular host, I can query the MySQL database to search for the Syslog related to that host. However, if I want to know the Syslog messages
coming from a particular site such as "site1", how can I do that? There is no "site1" information inside the Syslog messages.</div><div><br></div><div>I am thinking if I can modify the Syslog-NG configuration file such that I can add some information such as "site1" and make it as part of the Syslog messages, I can query the MySQL database for "site1" pattern. But I am not sure if I can do that or not.</div><div><br></div><div>If you have any suggestions/ideas, please let me know that.</div><div> </div><div>Regards,<br>Marcos</div></div></body></html>