>On Thu, Feb 28, 2002 at 05:18:43PM +0100, Michael Renner wrote:
> > Hiya!
> >
> > I've got a setup like this with many log hosts (~200, raising) and want to
> > split the server logfiles from those of our routers. i've got a setup like
> > this:
> > []
> >
> > This is a very ugly setup because i always have to add new servers to the
> > f_server filter, otherwise it would get logged in the router/unknown dir
> >
> > Is there a better way to solve this with one ip address or should i add a
> > secondary interface to the server and let the routers log to the second ip?
Maybe I am missing something here, but why not source from a different
facility for routers than local or servers. Facility can still be useful
;-/ if only to differ from a handful of source types, rather easily. Most syslog
sources allow some method to set the syslog facility they speak to.
Basically .... or am I over simplifying this?
filter f_router {
facility(local7); };
filter f_server {
facility(local6); };
filter f_local {
facility(local1); };
Good luck,
Ken Paris