Works great! Thanks...
Bill Nash <billn@billn.net> 1/29/2005 2:01:52 PM >>> On Sat, 29 Jan 2005, Fred Turner wrote:
Here is my source.. How would I go about doing that? Sorry I'm still pretty new with syslog0ng (3 hrs)...
No worries =)
source src { unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes));
Grab the udp and tcp entries, and create a new source. source src { unix-stream("/dev/log"); internal; }; source remote_hosts { tcp(port(5140) keep-alive(yes); udp()); log { source(remotes_hosts); destination(std); } Changing just the 'src' source, and adding the other two entries, will keep your existing config working as I described, local logging from your loghost processes to /var/log/messages where you'd expect them, and all your remote hosts logging to your 'dst' directory structure. Make sense? =) - billn
Bill Nash <billn@billn.net> 1/29/2005 1:46:15 PM >>>
Syslog will log to multiple destinations if you set them. As below, you have multiple facilities still logging to messages.
Does your 'src' source include your network ports, for receiving data from remote hosts? If it does, separate it to a new source and pair it with your 'std' destination, exclusively. This will keep your local logs separate from your remote logs.
- billn
On Sat, 29 Jan 2005, Fred Turner wrote:
Sure, it's as follows.
destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); };
log { source(src); filter(f_daemon); destination(messages); }; log { source(src); filter(f_kern); destination(messages); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(messages); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); };
Bill Nash <billn@billn.net> 1/29/2005 1:15:26 PM >>>
Can you include your log directive? Chances are, that's the culprit.
- billn
On Sat, 29 Jan 2005, Fred Turner wrote:
Hi, I'm new to syslog-ng and have configured it to be a loghost for many different firewall appliances. So I setup an automatic sorting entry as per the faq as follows:
destination std { file("/var/log/HOSTS/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) );
Which works prefect The only problem is that it's also putting them in the /var/log/messages log.
How Can I stop the behavior as it's creating a huge /var/log/messages log.
Thanks
==================================================================
NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
==================================================================
NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
==================================================================
NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.huhs that it's also putting them in the https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ================================================================== NOTE: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of BBi Enterprises Inc. Finally, the recipient should check this email and any attachments for the presence of viruses. BBi Enterprises Inc. accepts no liability for any damage caused by any virus transmitted by this email.