<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hello;<br><br>I have syslog clients that I would like to configure to send log-data to a middle-man/intermediary syslog-NG server. Once received on the intermediary, I want to immediately fork that data onto a different log-server, not syslog-NG; satisfying a requirement to feed two systems.<br><br>The reason for the fork is because the non-syslog-NG-server is running a proprietary logging system, and it must, at least for now, be capable of seeing *most* of my logs. It, the non-syslog-NG-server, is incapable of retransmitting to my syslog-NG server, nor would I trust it to do so.<br><br>My questions to the list are, <br>1. Has anyone successfully done something similar?<br>2. Any recommendations/gotchas I should be aware of?<br>3. Can I also configure syslog-NG to also resend Splunk data? Or do I have to run a Splunk Univ Forwarder configured similarly to my intermediary syslog-NG server to achieve that? (Yes, I know, OT question, sorry...)<br><br>Thank you in advance,<br><br>.vp<br><br><br><br><br><br> </div></body>
</html>