Hello;

I am in search for a way to graph my logs for four separate mailservers, 
since all four are logging onto the same syslog-ng host, 
I figured I'd use mailgraph, a tool which creates graphs using RRDtools.

I got rrdtools installed and ran mailgraph, and after not receiving any graph data at all in my database
(mailgraph.rrd file), I ran strace and saw:
 
write(2, "WARNING: line not in syslog form"..., 209) = 209
write(2, "WARNING: line not in syslog form"..., 167) = 167
write(2, "WARNING: line not in syslog form"..., 172) = 172
write(2, "WARNING: line not in syslog form"..., 173) = 173
write(2, "WARNING: line not in syslog form"..., 194) = 194
write(2, "WARNING: line not in syslog form"..., 172) = 172

My syslog-ng.conf has the following relevant data for this particular source:

options
  {
    chain_hostnames(no);
    create_dirs (yes);
    dir_perm(0755);
    use_dns (yes);
    dns_cache(yes);
    dns_cache_size(1000);
    dns_cache_expire(604800);
    keep_hostname(yes);
    log_fifo_size(10000);
    log_msg_size(8192);
    long_hostnames(on);
    perm(0644);
    stats(3600);
    sync(0);
    time_reopen (10);
    use_dns(yes);
    use_fqdn(yes);
  };

log { source(S_udp); filter(F_mailservers); destination(D_mailservers); flags(final); };
destination D_mailservers  { file("/var/log/Acme-Hosts/MailServers/$FULLHOST.log"
                             perm(0644)); };


My logs look like:
 
Sep  5 16:31:45 mailserver.example.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 597816CB1E: from=<203176.549962556@abc.exampletest.com>, size=14602, nrcpt=1 (queue active)
 
Sep  5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 3081A6CB1C: removed
 
Sep  5 16:31:45 mailserver.mailserver.net/mailserver.example.net postfix/qmgr[27362]: [ID 197553 mail.info] 1C0426CB1D: removed
 
Is there a way that I can tel syslog-ng to output to two locations, on e in the format above, which I need, and another in the format that mailgraph expexts to see?

I assume that mailgraph is not setup to see the HOSTNAME/HOSTNAME entries shown above.

I am using syslog-ng, latest, and am purposely stuffing my data into files named after the host, into a directory named after the same.
I am also using a FIFO to redirect all logged data into a mysql DB, but the script mailgraph is receiving it's data from the flat files above.

Any help appreciated, especially in a way that would not require rewriting the way the data looks now.
 
Thanks all,
 
.vp