there's actually a ton of ways to do it.

Roughly in the order I would try them:

1) If the different logs you want to separate use different priorities, facilities, programs - you can directly reference those in filters.

2) If you need to (or choose to) modify the logs yourself - you can use program_override() to write a different string in that section of the syslog message, then filter on that on the receiving end. NOTE: This option replaces the deprecated log_prefix() option.

3) You can also use match(regexp value("MACRO")) where MACRO is MSG or MSGHDR in the filter to filter messages based on a regex to match text.

Jim

On 09/08/2014 09:46 AM, wiskbroom@hotmail.com wrote:

I had thought about that, but how do I differentiate the individual logs on the receiving end?
Doing so would certainly remove the need for me to listen on two ports, and split output to two ports.

Thank you,

.vp

Vadim Anatoly Pushkin -- The Ukranian Stallion --

Date: Fri, 5 Sep 2014 23:24:25 -0400
From: jrhendri@roadrunner.com
To: syslog-ng@lists.balabit.hu
Subject: Re: [syslog-ng] Individual Logs Files to each Forward to Different server/port?

Quick thought. Look at filters on the receiving end. Might be easier.

Jim

Sent from my Verizon Wireless 4G LTE smartphone

-------- Original message --------
From: wiskbroom@hotmail.com
Date:09/05/2014 5:42 PM (GMT-05:00)
To: syslog-ng@lists.balabit.hu
Cc:
Subject: [syslog-ng] Individual Logs Files to each Forward to Different server/port?

Greetings!

Is is possible to configure a syslog-ng client to forward logs to a syslog-ng server based on file?

I am thinking of the following as an example:

destination named-LOGS {
udp(ip(192.168.1.100) port(555));
};
source named {
file("/var/log/named/bind.log" log_prefix("BIND-LOGS"));
};
log {
source(named);
destination(named-LOGS);
};

destination dhcpd-LOGS {
udp(ip(192.168.1.100) port(556));
};
source dhcpd {
file("/var/log/dhcpd/dhcp.log" log_prefix("DHCPD-LOGS"));
};
log {
source(dhcpd);
destination(dhcpd-LOGS);
};

In this example, I am sending each to the same destination IP address, although that is configurable, but each log file to a different port, and with a different log_prefix as well.

Does this OK,or is their a simpler way?

Many thanks,

.vp

Vadim Anatoly Pushkin
-- The Ukranian Stallion --

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq