<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body><div>flags (final) stops the professing in the first statement </div><div><br></div><div><br></div><div><br></div><div id="composer_signature"><div style="font-size:85%;color:#575757" dir="auto">Sent from my Verizon, Samsung Galaxy smartphone</div></div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Original message --------</div><div>From: wiskbroom@hotmail.com </div><div>Date: 4/21/17 9:37 AM (GMT-05:00) </div><div>To: syslog-ng@lists.balabit.hu </div><div>Subject: [syslog-ng] Unable to Filter Based On Facility into Different Files </div><div><br></div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif" dir="ltr">
<p>Greetings!<br>
</p>
<p><br>
</p>
<p>I am trying to rewrite syslog-ng.conf to create files based on facilities; one way for non-auth messages, another for all authentication messages (ssh, su, sudo, and console logins).</p>
<p><br>
</p>
<p>I believe I have two issues with my statements below:</p>
<p>1. My ${HOST}- might be incorrect.</p>
<p>2. Am I able to write two filters for a single source? My single source in this case are Linux boxes, all sending their syslog traffic to my syslog-NG server with *.*.</p>
<p><br>
</p>
<p>My statements below, comments and criticism very welcome.</p>
<p><br>
</p>
<p>filter f_linux_secure { facility(authpriv) and level(info..emerg); };<br>
filter f_linux_messages { level(info..emerg); };<br>
<br>
<br>
destination d_linux_secure {<br>
file("/data/Linux/$<wbr>{HOST}-secure.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes));<br>
destination d_linux_messages {<br>
file("/data/Linux/$<wbr>{HOST}-messages.log" owner("root") group("systems") perm(0640) dir_perm(0750) create_dirs(yes));<br>
<br>
log { source(s_remote); filter(f_linux_secure); destination(d_linux_secure); flags(final); };<br>
log { source(s_remote); filter(f_linux_messages); destination(d_linux_messages); flags(final); };</p>
<p><br>
</p>
<p><br>
</p>
<p>Regards,</p>
<p><br>
</p>
<p><br>
</p>
<div id="Signature">Vadim Anatoly Pushkin </div>
</div>
</body></html>