<div dir="ltr">Well, 1.6.x was branched around 2004 and was maintained for some more years (until 2007 Feb). Then syslog-ng 2.0 was rewritten from scratch. (rewrite starte in 2001 the first release in 2006).<br><br>So I would definitely upgrade, it's been a complete rewrite away for almost a decade.<br><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Wed, Feb 11, 2015 at 11:58 PM, Jakub Jankowski <span dir="ltr"><<a href="mailto:shasta@toxcorp.com" target="_blank">shasta@toxcorp.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On <a href="tel:11.02.2015" value="+3611022015">11.02.2015</a> 23:33, Manning, Lee wrote:<br>
> In version 1.6.11 of syslog-ng, I need to send Apache logs to a<br>
> different loghost than the rest of the system logs. Is that possible?<br>
> If so, how?<br>
><br>
> Our syslog-ng was set up quite some time ago by an admin who is no<br>
> longer around. I’ve spent more time than I can afford trying to<br>
> decipher and attempt to modify his syslog-ng.conf. Assistance from some<br>
> experts would be greatly appreciated.<br>
<br>
</div></div>Am I reading it right? 1.6.11? That's... ancient (2006?). This may be<br>
not the suggestion you're looking for, but I think you should start with<br>
upgrading (although if you're running syslog-ng 1.6.11, chances are the<br>
system you're running it on is even older).<br>
It might take you less time (in the long run) to configure your new<br>
syslog-ng server from scratch, using up-to-date software components,<br>
than trying to get it done in your current setup - also considering<br>
possible bugs that might have been fixed since 1.6.xx.<br>
My argument is that most of the online resources you can get help from<br>
(like, this mailing list, or blog posts, etc) may be more relevant to<br>
some decent versions of syslog-ng.<br>
<br>
But if you have to use 1.6.11, start by reading<br>
<a href="http://www.syslog.org/syslog-ng/v1/" target="_blank">http://www.syslog.org/syslog-ng/v1/</a><br>
<br>
Idea should be the similar - depending on how you get your apache logs,<br>
either separate sources and separate destinations (udp() or tcp(), I<br>
assume), or single source, and then appropriate filter to pick only<br>
apache logs and send them to your specific destination.<br>
<br>
<br>
<br>
HTH,<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Jakub Jankowski|<a href="mailto:shasta@toxcorp.com">shasta@toxcorp.com</a>|<a href="http://toxcorp.com/" target="_blank">http://toxcorp.com/</a><br>
GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</font></span></blockquote></div><br></div>