<div dir="ltr"><div style="font-size:12.8px">That was a bad example on my part. I will need unique filters for each destination. </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">log {<br> source(s_net_tcp); <br> channel { filter(f_allpci); destination (d_splunk_PCI); };<br> channel { filter(f_allpci); destination (d_sumo_PCI); };<br></div><div style="font-size:12.8px"> channel { filter(f_swpci); destination (d_secureworks); };<br>}; </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Jan 21, 2018 at 9:41 PM, Scot <span dir="ltr"><<a href="mailto:scotrn@gmail.com" target="_blank">scotrn@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Evan, <div>Thats very helpful, is there somewhere these performance considerations are outlined? </div><div>Only think I see related is 2.2.1 in the manual. </div><div><br></div><div>I'll try tying combining the destinations under on log statement in the morning. </div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Sat, Jan 20, 2018 at 11:02 AM, Evan Rempel <span dir="ltr"><<a href="mailto:erempel@uvic.ca" target="_blank">erempel@uvic.ca</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div text="#000000" bgcolor="#FFFFFF">
<div class="m_8945445071974058476m_3686659491037748065moz-cite-prefix">I would favour a config like<br>
<br>
<div>log {<br>
source(s_net_tcp); <br>
channel { filter(f_pci); destination (d_splunk_PCI); };<br>
channel { filter(f_pci); destination (d_sumo_PCI); };<br>
</div>
<div> channel { filter(f_pci); destination (d_secureworks); };<br>
};<br>
</div>
<div><br>
Although I think your config should work I don't like the idea
of "re-sourcing" the stream.<br>
<br>
Now that I look closer at what you have done you are using the
same filter, so it could be<br>
<br>
<div><span>log {<br>
source(s_net_tcp); <br>
filter(f_pci);<br>
destination (d_splunk_PCI);<br></span>
destination (d_sumo_PCI);<br>
</div>
<div> destination (d_secureworks);<br>
};<br>
</div>
<div><br>
<br>
which takes the source, filters it and sends to all three
destinations.<span class="m_8945445071974058476HOEnZb"><font color="#888888"><br>
<br>
Evan.<br>
</font></span></div>
</div><div><div class="m_8945445071974058476h5">
<br>
<br>
On 01/20/2018 07:28 AM, Scot wrote:<br>
</div></div></div><div><div class="m_8945445071974058476h5">
<blockquote type="cite">
<div dir="ltr">Thanks Jim,
<div>I have 4 configs
<div>sources.conf</div>
<div>destinations.conf </div>
<div>filters.conf</div>
<div>log.conf </div>
<div><br>
</div>
<div>Can't post them without revealing sensitive network info
but wanted to make sure I wasn't assuming something should
just work. </div>
<div>I'll post more after I dig into it but seems to favor the
first matching log destination when I switch the order and
reload with syslog-ng-ctl. </div>
<div><br>
</div>
<div>log { source(s_net_tcp); filter(f_pci); destination
(d_splunk_PCI);};<br>
</div>
<div>log { source(s_net_tcp); filter(f_pci); destination
(d_sumo_PCI);};<br>
</div>
<div>log { source(s_net_tcp); filter(f_pci); destination
(d_secureworks);};<br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Jan 19, 2018 at 6:41 PM,
james.r.hendrick <span dir="ltr"><<a href="mailto:james.r.hendrick@gmail.com" target="_blank">james.r.hendrick@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div>It should work. Would you share the config?</div>
<div>Jim</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div id="m_8945445071974058476m_3686659491037748065m_5017559045485440611composer_signature">
<div style="font-size:85%;color:#575757" dir="auto">Sent
from my Verizon, Samsung Galaxy smartphone</div>
</div>
<div>
<div class="m_8945445071974058476m_3686659491037748065h5">
<div><br>
</div>
<div style="font-size:100%;color:#000000">
<div>-------- Original message --------</div>
<div>From: Scot <<a href="mailto:scotrn@gmail.com" target="_blank">scotrn@gmail.com</a>>
</div>
<div>Date: 1/19/18 4:23 PM (GMT-05:00) </div>
<div>To: Syslog-ng users' and developers' mailing
list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>>
</div>
<div>Subject: [syslog-ng] One source multiple
destinations ? </div>
<div><br>
</div>
</div>
<div dir="ltr">I'm having a problem where I am trying
to take input source(s) and write them out to
multiple destinations.
<div><br>
</div>
<div>Before I go barking up the wrong tree I just
wanted to make sure I wasn't missing something. </div>
<div><br>
</div>
<div>We should be able to take a source and send it
to file, elastic-search and SPLUNK and sumologic
all at the same time right ? </div>
<div><br>
</div>
<div>Troubleshooting an odd behavior where only one
network destination will work but then I switch
the order the other starts working.</div>
<div><br>
</div>
<div>I know it's vague but has anyone seen this
behavior? </div>
<div><br>
</div>
<div>Thanks </div>
<div>Scot </div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<br>
</div></div></div>
<br></div></div><span class="">______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></span></blockquote></div><br></div>
</blockquote></div><br></div>