2007/8/12, Jim Hendrick <jrhendri@maine.rr.com>:

Excuse me if you've already thought of this but, I assume your servers have
multiple NICs on separate networks. Why would the same server forward its
syslog messages to your central log server using different NICs? Wouldn't
normal routing force it to connect using one NIC all the time?

no, one reason why we use multiple network is that we have at least one network backup for servers.

i.e. is this really a problem? Have you seen the same server use different
NICs to talk to your log server?

yes

If you really are seeing this (and can't fix it at the source) I suppose you
could use a filter to look at the messages and define different destinations
for each server, using a regexp on the host to determine which to put where.

to difficult to maintain, we have often some servers who are added to the network,
i could write a shell script for auto-generate a config file but that seems ugly.
but apparently, there is only ugly solutions for what i want:

i could either:
- put statically my servers in /etc/hosts
- put statically my servers in the syslog-ng.conf
- auto-create a syslog-ng.conf file each days through a crontab
- hack the syslog-ng source
- pass by program(); and call a script for auto-generate symlink

as you can see, there is multiple solutions, i will choose one of them i think.

thanks all for your help.

--
Mobidyc