Gergely,<div><br></div><div>Here all three log {} gets executed. What i am basically looking for is a "if..else" or "case" sort of condition where only one of client-relay communication happens based on hostname of client system.</div>
<div><br></div><div><div>Aug 22 02:33:39 sj1slm227 syslog-ng[1166]: Syslog connection established; fd='12', server='AF_INET(10.5.81.89:514)', local='AF_INET(<a href="http://0.0.0.0:0">0.0.0.0:0</a>)'</div>
<div><b>Aug 22 02:36:48 sj1slm227 syslog-ng[1166]: Syslog connection failed; fd='66', server='AF_INET(10.116.104.86:514)', error='Connection timed out (110)', time_reopen='60'</b></div><div>
<b>Aug 22 02:36:48 sj1slm227 syslog-ng[1166]: Syslog connection failed; fd='65', server='AF_INET(10.129.104.21:514)', error='Connection timed out (110)', time_reopen='60'</b></div><br><div class="gmail_quote">
On Wed, Aug 22, 2012 at 3:01 PM, sagar naravane <span dir="ltr"><<a href="mailto:sagar.naravane@gmail.com" target="_blank">sagar.naravane@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Shouldn't it be <div><br></div><div><span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">filter f_colo_sj { host("^sj1*"); };</span><br style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
<span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">filter f_colo_du { host("^du1*"); };</span><br style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
<span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">filter f_colo_da { host("^da1*"); };</span> </div><div><br></div><div>Sagar<div><div class="h5"><br><br><div class="gmail_quote">
On Wed, Aug 22, 2012 at 2:55 PM, Gergely Nagy <span dir="ltr"><<a href="mailto:algernon@balabit.hu" target="_blank">algernon@balabit.hu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div>sagar naravane <<a href="mailto:sagar.naravane@gmail.com" target="_blank">sagar.naravane@gmail.com</a>> writes:<br>
<br>
> I am a newbie to syslog-ng solution. I am trying to create a common config<br>
> file to be distributed across client machines in San Jose, Dallas and<br>
> Dublin colos. Every colo has 1 dedicated relay which forwards log data to a<br>
> central server<br>
><br>
> (SJ|DU|DA)_ client --> (SJ|DU|DA)_ relay --> SYSLOG-NG server<br>
><br>
> the clients located in these colos have sj,du & da in their hostnames eg<br>
> da1xxx058, du1xxx059, sj1xxx060. I want to setup the config in a way that<br>
> based on hostname the config decides what relay to connect to.<br>
><br>
> Is this possible ?<br>
<br>
</div></div>Yep, it is.<br>
<br>
One way to do it is to use filters: you set up a filter that matches<br>
each colo, and set up your destinations so that each message that<br>
matches a given colo filter, goes to the appropriate relay.<br>
<br>
Something along these lines:<br>
<br>
filter f_colo_sj { host("^sj"); };<br>
filter f_colo_du { host("^du"); };<br>
filter f_colo_da { host("^da"); };<br>
<br>
destination d_relay_sj { ... };<br>
...<br>
<br>
log {<br>
source(s_local);<br>
filter(f_colo_sj);<br>
destination(d_relay_sh);<br>
flags(final);<br>
};<br>
<br>
log {<br>
source(s_local);<br>
filter(f_colo_du);<br>
destination(d_relay_du);<br>
flags(final);<br>
};<br>
<br>
...and so on and so forth. The disadvantage here is that you need a<br>
filter and a destination for each relay, but with only 3 relays, that's<br>
bearable.<br>
<span><font color="#888888"><br>
--<br>
|8]<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div></div></div><span class="HOEnZb"><font color="#888888">-- <br>Regards,<br><br>Sagar Naravane<br>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Regards,<br><br>Sagar Naravane<br>
</div>