<div class="gmail_quote">Le 11 nov. 2011 17:06, "Matt Zagrabelny" <<a href="mailto:mzagrabe@d.umn.edu">mzagrabe@d.umn.edu</a>> a écrit :<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
I am trying to ship a bunch of apache log files across the network and<br>
on the syslog-ng server side then break them into their individual<br>
files again.<br>
<br>
I am not sure the best way to do this, but it looks like tags might be helpful.<br>
<br>
On my apache system I have the following snippets:<br>
<br>
-----{syslog-ng client begin}-----<br>
<br>
source s_apache_access {<br>
file("/var/log/apache2/access.log"<br>
tags("main_access")<br>
);<br>
};<br>
<br>
source s_apache_other_vhost_access {<br>
file("/var/log/apache2/other_vhost.log"<br>
tags("other_vhost_access")<br>
);<br>
};<br>
<br>
destination d_server {<br>
syslog(<br>
"10.0.0.1"<br>
transport("tls")<br>
port(6514)<br>
tls(<br>
peer-verify(required-trusted)<br>
ca_dir('/etc/syslog-ng/ssl/ca.d')<br>
key_file('/etc/syslog-ng/ssl/server.key')<br>
cert_file('/etc/syslog-ng/ssl/server.crt')<br>
)<br>
);<br>
};<br>
<br>
log {<br>
source(s_apache_access);<br>
source(s_apache_other_vhost_access);<br>
destination(d_server);<br>
};<br>
<br>
-----{syslog-ng client end}-----<br>
<br>
On my server I have the following:<br>
<br>
-----{syslog-ng server begin}-----<br>
<br>
source s_tls {<br>
syslog(<br>
ip(0.0.0.0)<br>
port(6514)<br>
transport("tls")<br>
tls(<br>
peer-verify(required-trusted)<br>
ca_dir('/etc/syslog-ng/ssl/ca.d')<br>
key_file('/etc/syslog-ng/ssl/server.key')<br>
cert_file('/etc/syslog-ng/ssl/server.crt')<br>
)<br>
max_connections(1000)<br>
keep_hostname(yes)<br>
);<br>
};<br>
<br>
filter f_main_apache_access {<br>
tags("main_access");<br>
};<br>
<br>
destination d_main_access {<br>
file("/var/log/apache2/access.log");<br>
};<br>
<br>
log {<br>
source(s_tls);<br>
filter(f_main_apache_access);<br>
destination(d_main_access);<br>
};<br>
<br>
-----{syslog-ng server end}-----<br>
<br>
It doesn't look like the "tag" is being preserved through the network.<br>
Does anyone know if tags is the right mechanism for splitting apart<br>
(filtering) the aggregate stream coming in on the server?<br>
<br>
Any other advice would be greatly appreciated.<br>
<br>
Thanks!<br>
<br>
-matt zagrabelny<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>