<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Yes, agree. I wanted to include local configuration so that it was clear what that was. I'll check today and confirm. BTW, since this scenario is likely to be a common scenario, I am more than willing to donate this to the FAQ so that it helps someone else
as well. <br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Fekete, Róbert <robert.fekete@balabit.com><br>
<b>Sent:</b> Thursday, November 10, 2016 12:18:03 AM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list<br>
<b>Subject:</b> Re: [syslog-ng] Possible elementary question</font>
<div> </div>
</div>
<div>
<div dir="ltr">Hi,
<div><br>
</div>
<div>The configs in your mail refer to your local servers, and you want to segregate the logs on your central logserver into separate files.</div>
<div>For that, you have to use a file destination on the logserver that uses macros in its filename, something like: </div>
<div><br>
</div>
<div>
<pre class="gmail-prettyprint gmail-synopsis gmail-prettyprinted" style="overflow:auto;white-space:pre-wrap;padding:2px;font-family:courier,fixed;font-size:0.8em;background-color:rgb(224,224,224);color:rgb(0,0,0);border:1px solid rgb(136,136,136)"><span class="gmail-pln">destination d_file </span><span class="gmail-pun" style="color:rgb(102,102,0)">{</span><span class="gmail-pln">
file</span><span class="gmail-pun" style="color:rgb(102,102,0)">(</span><span class="gmail-str" style="color:rgb(0,136,0)">"/var/log/${HOST}/${PROGRAM}.log"</span><span class="gmail-pun" style="color:rgb(102,102,0)">);</span><span class="gmail-pln">
</span><span class="gmail-pun" style="color:rgb(102,102,0)">};</span></pre>
</div>
<div>(Though I'd recommend using some DATE macros as well)</div>
<div><br>
</div>
<div>For details, see <a href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/configuring-destinations-file.html">
https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/configuring-destinations-file.html</a><br>
</div>
<div><br>
</div>
<div>HTH, </div>
<div><br>
Robert</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Nov 10, 2016 at 2:13 AM, Varugis Kurien <span dir="ltr">
<<a href="mailto:vkurien@midfinsystems.com" target="_blank">vkurien@midfinsystems.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div id="m_-254832633728636251divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif" dir="ltr">
<p>I'm having some conniptions doing central logging using syslog-ng. Here is the scenario:</p>
<ol>
<li>I generate logs using syslog-ng on local servers and then send them to a log-destination server. Here is an example of some of the conf files on the generating server:</li></ol>
<p></p>
<div><b>more iptables.log.conf </b><br>
<i>source s_var_log_iptables.log { file("/var/log/iptables.log" program-override(var_log_<wbr>iptables.log) flags(no-parse)); };<br>
log { source(s_var_log_iptables.log)<wbr>; destination(d_midfin_logger_2)<wbr>; };</i></div>
<p></p>
<p><br>
</p>
<p></p>
<div><b>more midfin_logger_2.conf </b><br>
<i>template t_sdx_tagged {<br>
template("$ISODATE $HOST $PROGRAM $MSG<br>
");<br>
template_escape(no);<br>
};<br>
destination d_midfin_logger_2 { tcp( "10.4.16.161" port(514) template(t_sdx_tagged)); };<br>
<br>
</i><br>
<br>
What I am trying to do on the log host is to:<br>
<br>
<ol>
<li>Segregate at the top level by host. For each such host:
<ol>
<li>Split the logs into different directories so that for example, I'll have one directory for the audit log from that host, another for iptables etc - so that under each host I'll have /var/log/iptables.log etc.
<br>
</li></ol>
</li></ol>
I've been unable to grok the documentation to figure out quite how to do this and would really appreciate some help.<br>
<br>
thanks<br>
vk<br>
==<br>
<br>
<br>
</div>
<p></p>
</div>
</div>
<br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">
https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">
http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">
http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</body>
</html>