On Mon, Jan 07, 2002 at 06:36:02PM -0500, Ed Ravin wrote:
Over at the central server, you need to define the source:
source src { tcp(port(NNN) max-connections(500)); internal(); };
You might want to put in other sources, such as local syslog messages or kernel messages. See the documentation for more description of the source and destination directives.
I usually separate the net sources from the local: source net { tcp(port... }; That way, I can have special rules for host-specific logs while still keeping my standard local loggin setup for the central server itself. -- Chad Walstrom <chewie@wookimus.net> | a.k.a. ^chewie http://www.wookimus.net/ | s.k.a. gunnarr Get my public key, ICQ#, etc. Send email w/the Subject: "get help"