By specifying this filter(f_local0); filter(f_local1); in your log statement you are saying that each message must match *both* facility local0 *and* local1, which will never be the case, and no messages will ever be written to the destination. What you want is filter f_local01 { facility(local0) or facility(local1); }; log { source(s_tcp); source(s_internal); source(s_udp); source(s_unix); filter(f_local01); destination(df_local1); }; I hope this is helpfull. Evan. Javier Terceiro wrote:
Hello,
I have this config file:
filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; destination df_local1 { file("/mnt/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/local.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_tcp); source(s_internal); source(s_udp); source(s_unix); filter(f_local0); filter(f_local1); destination(df_local1); };
When an event arrives at the system by facility local0 or local1, this one is registered in the file never. Can be some bug of syslog-ng or failure in config?
some idea of so that this one failure happens?
Best regards and thanks in advance.
-- Evan Rempel erempel@uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria