<html><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:12pt"><div><span>Hi Robert,</span></div><div><span><br></span></div><div><span>Thanks for your suggestion and I am now trying to follow your 3rd suggestion. I will let you know if I can make it or not.</span></div><div><span><br></span></div><div><span>However, I would also like to know more the details of your 1st suggestion. My understanding of template is Syslog-NG has some built-in MACRO such as HOST, FACILITY, PRIORITY, TAG, PROGRAM, MSG and etc. Other than those built-in MACRO, can I create some for myself, such as SITE_CODE? It would be appreciated if you can let me know more about it or show me the pointer how to learn more about the template.</span></div><div> </div><div>Regards,<br>Marcos<br></div><div style="font-size: 12pt; font-family: verdana, helvetica, sans-serif; "><div style="font-size: 12pt; font-family: 'times new
roman', 'new york', times, serif; "><font size="2" face="Arial"><hr size="1"><b><span style="font-weight:bold;">From:</span></b> Fekete Robert <frobert@balabit.hu><br><b><span style="font-weight: bold;">To:</span></b> Marcos Tang <marcostang2002@yahoo.com>; Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br><b><span style="font-weight: bold;">Sent:</span></b> Wednesday, August 3, 2011 9:05 PM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: [syslog-ng] How to manage the Syslog-NG messages coming from different sites? Each sites has their Syslog-NG clients?<br></font><br>Hi,<br><br>There are several ways to achieve this:<br>- Use a custom template in the destination definition of your clients (or the <br>site's main syslog server that forwards the messages to your central logserver) <br>that includes the sitename in the log message, then extract this info from the <br>message (for example, with a
csv parser) on the server side<br><br>- If you use the RFC5424 syslog message format, you can add the sitename into <br>the SDATA part of the message, and access it with a macro on the central server<br><br>- You can configure your central server to listen on different IP addresses or <br>different ports, one for each site, and create separate sources in your server's <br>config for every site. syslog-ng automatically adds a tag (the id of the source) <br>to every message, so you can use this tag to filter the messages to different <br>databases or tables (or just include it in an extra column).<br><br>HTH,<br><br>Robert<br><br>On 08/03/2011 12:20 PM, Marcos Tang wrote:<br><br>> Hi,<br>><br>> I have a problem to manage the Syslog-NG messages sending from different<br>> Syslog-NG clients at different remote sites.<br>><br>> For example, I have 10 sites (site1, site2, site3 to site 10) running Syslog-NG<br>> clients. Each site has one
Syslog-NG server and all the Syslog messages will be<br>> forwarded to the centralized Syslog-NG server and insert into the MySQL database<br>> at the headquarter finally.<br>><br>> Now, I can see all the Syslog messages at the headquarter MySQL database; but it<br>> is hard for me to manage them.<br>><br>> For example, if I know the hostname of a particular host, I can query the MySQL<br>> database to search for the Syslog related to that host. However, if I want to<br>> know the Syslog messages coming from a particular site such as "site1", how can<br>> I do that? There is no "site1" information inside the Syslog messages.<br>><br>> I am thinking if I can modify the Syslog-NG configuration file such that I can<br>> add some information such as "site1" and make it as part of the Syslog messages,<br>> I can query the MySQL database for "site1" pattern. But I am not sure if I can<br>> do that or
not.<br>><br>> If you have any suggestions/ideas, please let me know that.<br>> Regards,<br>> Marcos<br>><br>><br>><br>> ______________________________________________________________________________<br>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>><br><br><br><br><br></div></div></div></body></html>