<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>I'm having some conniptions doing central logging using syslog-ng. Here is the scenario:</p>
<ol>
<li>I generate logs using syslog-ng on local servers and then send them to a log-destination server. Here is an example of some of the conf files on the generating server:</li></ol>
<p></p>
<div><b>more iptables.log.conf </b><br>
<i>source s_var_log_iptables.log { file("/var/log/iptables.log" program-override(var_log_iptables.log) flags(no-parse)); };<br>
log { source(s_var_log_iptables.log); destination(d_midfin_logger_2); };</i></div>
<p></p>
<p><br>
</p>
<p></p>
<div><b>more midfin_logger_2.conf </b><br>
<i>template t_sdx_tagged {<br>
template("$ISODATE $HOST $PROGRAM $MSG<br>
");<br>
template_escape(no);<br>
};<br>
destination d_midfin_logger_2 { tcp( "10.4.16.161" port(514) template(t_sdx_tagged)); };<br>
<br>
</i><br>
<br>
What I am trying to do on the log host is to:<br>
<br>
<ol>
<li>Segregate at the top level by host. For each such host:
<ol>
<li>Split the logs into different directories so that for example, I'll have one directory for the audit log from that host, another for iptables etc - so that under each host I'll have /var/log/iptables.log etc.
<br>
</li></ol>
</li></ol>
I've been unable to grok the documentation to figure out quite how to do this and would really appreciate some help.<br>
<br>
thanks<br>
vk<br>
==<br>
<br>
<br>
</div>
<p></p>
</div>
</body>
</html>