<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I had thought about that, but how do I differentiate the individual logs on the receiving end?<br>Doing so would certainly remove the need for me to listen on two ports, and split output to two ports.<br><br>Thank you,<br><br>.vp<br><br> Vadim Anatoly Pushkin
-- The Ukranian Stallion --<br><br><div><hr id="stopSpelling">Date: Fri, 5 Sep 2014 23:24:25 -0400<br>From: jrhendri@roadrunner.com<br>To: syslog-ng@lists.balabit.hu<br>Subject: Re: [syslog-ng] Individual Logs Files to each Forward to Different server/port?<br><br><div>Quick thought. Look at filters on the receiving end. Might be easier.</div><div>Jim</div><div><br></div><div><br></div><div><div style="font-size:9px;color:#575757;">Sent from my Verizon Wireless 4G LTE smartphone</div></div><div></div><br><br>-------- Original message --------<br>From: wiskbroom@hotmail.com <br>Date:09/05/2014 5:42 PM (GMT-05:00) <br>To: syslog-ng@lists.balabit.hu <br>Cc: <br>Subject: [syslog-ng] Individual Logs Files to each Forward to Different server/port? <br><br><div dir="ltr">Greetings!<br><br>Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file?<br><br>I am thinking of the following as an example:<br><br>destination named-LOGS {<br>
udp(ip(192.168.1.100) port(555));<br>
};<br>
source named {<br>
file("/var/log/named/bind.log" log_prefix("BIND-LOGS"));<br>
};<br>
log {<br>
source(named);<br>
destination(named-LOGS);<br>
};<br><br><br>destination dhcpd-LOGS {<br>
udp(ip(192.168.1.100) port(556));<br>
};<br>
source dhcpd {<br>
file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS"));<br>
};<br>
log {<br>
source(dhcpd);<br>
destination(dhcpd-LOGS);<br>
};<br><br><br>In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well.<br><br><br>Does this OK,or is their a simpler way?<br><br><br>Many thanks,<br><br><br>.vp<br><br> Vadim Anatoly Pushkin
<br>-- The Ukranian Stallion --<br><br> </div>
<br>______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq</div> </div></body>
</html>