On Thu, Feb 28, 2002 at 05:18:43PM +0100, Michael Renner wrote:
Hiya!
I've got a setup like this with many log hosts (~200, raising) and want to split the server logfiles from those of our routers. i've got a setup like this: []
This is a very ugly setup because i always have to add new servers to the f_server filter, otherwise it would get logged in the router/unknown dir
Is there a better way to solve this with one ip address or should i add a secondary interface to the server and let the routers log to the second ip?
Maybe I am missing something here, but why not source from a different facility for routers than local or servers. Facility can still be useful ;-/ if only to differ from a handful of source types, rather easily. Most syslog sources allow some method to set the syslog facility they speak to. Basically .... or am I over simplifying this? filter f_router { facility(local7); }; filter f_server { facility(local6); }; filter f_local { facility(local1); }; Good luck, Ken Paris