<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I assume you are still using these config settings (from your August
emails)<br>
<br>
<div style="background-color: transparent;" class="">options {</div>
<div style="background-color: transparent;" class=""><span class=""
style="white-space:pre"> </span>flush_lines (0);</div>
<div style="background-color: transparent;" class=""><span class=""
style="white-space:pre"> </span>time_reopen (10);</div>
<div style="background-color: transparent;" class=""><span class=""
style="white-space:pre"> </span>log_fifo_size (1000);</div>
<div style="background-color: transparent;" class=""><span class=""
style="white-space:pre"> </span>long_hostnames (off);</div>
<div style="background-color: transparent;" class=""><span class=""
style="white-space:pre"> </span>use_dns (no);</div>
<div style="background-color: transparent;" class=""><span class=""
style="white-space:pre"> </span>use_fqdn (no);</div>
<div style="background-color: transparent;" class=""><span class=""
style="white-space:pre"> </span>create_dirs (no);</div>
<div style="background-color: transparent;" class=""><span class=""
style="white-space:pre"> </span>keep_hostname (yes);</div>
<div style="background-color: transparent;" class="">};<br>
<br>
Please try changing create_dirs()<br>
<br>
Also - I suggest you browse / search the excellent documentation
at the balabit site.<br>
<br>
We are happy to help, but most of your questions are answered
there<br>
<br>
Jim<br>
<br>
<br>
<br>
</div>
<br>
<div class="moz-cite-prefix">On 12/10/2014 06:11 AM, Jason Long
wrote:<br>
</div>
<blockquote
cite="mid:1078397419.556272.1418209876442.JavaMail.yahoo@jws100203.mail.ne1.yahoo.com"
type="cite">
<pre wrap="">Hello
I change my configuration to :
destination d_separatedbyhosts {
file( "/var/log/$HOST/$HOST.$FACILITY.$SEVERITY.$YEAR.$MONTH.$DAY"owner("root") group("root") perm(0644)); };
log { source(s_netsyslog); destination(d_separatedbyhosts); };
but I when I browse /var/log , I can't see any new file or folder :(. What is the problem?
Cheers.
On Saturday, December 6, 2014 7:29 PM, Jim Hendrick <a class="moz-txt-link-rfc2396E" href="mailto:jrhendri@roadrunner.com"><jrhendri@roadrunner.com></a> wrote:
very simple.
destination d_separatedbyhosts {
file( "/var/log/$HOST/$HOST.$FACILITY.$SEVERITY.$YEAR.$MONTH.$DAY" );
}
(didn't you ask this back in August?)
</pre>
<blockquote type="cite">
<pre wrap="">Hello all.
How are you?
I have a windows sever with Syslog agent installed on it and it forward all logs to my Linux box. My Syslog-NG collected it very well but I want to Forward another Windows Events into my Syslog server but How can I modify my current config file for create another file for this new server? I use Logstash and Kibana on my Linux Box, Can it detect my new Log file automatically?
# syslog-ng configuration file.
#
# This should behave pretty much like the original syslog on RedHat. But
# it could be configured a lot smarter.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
#
options {
flush_lines (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};
source s_netsyslog {
udp(ip(0.0.0.0) port(514) flags(no-hostname));
tcp(ip(0.0.0.0) port(514) flags(no-hostname));
};
destination d_netsyslog { file("/var/log/network.log" owner("root") group("root") perm(0644)); };
log { source(s_netsyslog); destination(d_netsyslog); };
as you see it collect Syslog from any IP address.
Cheers.
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<br>
</body>
</html>