Yes, agree. I wanted to include local configuration so that it was clear what that was. I'll check today and confirm. BTW, since this scenario is likely to be a common scenario, I am more than willing to donate this to the FAQ so that it helps someone else as well. ________________________________ From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Fekete, R?bert <robert.fekete@balabit.com> Sent: Thursday, November 10, 2016 12:18:03 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Possible elementary question Hi, The configs in your mail refer to your local servers, and you want to segregate the logs on your central logserver into separate files. For that, you have to use a file destination on the logserver that uses macros in its filename, something like: destination d_file { file("/var/log/${HOST}/${PROGRAM}.log"); }; (Though I'd recommend using some DATE macros as well) For details, see https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-o... HTH, Robert On Thu, Nov 10, 2016 at 2:13 AM, Varugis Kurien <vkurien@midfinsystems.com<mailto:vkurien@midfinsystems.com>> wrote: I'm having some conniptions doing central logging using syslog-ng. Here is the scenario: 1. I generate logs using syslog-ng on local servers and then send them to a log-destination server. Here is an example of some of the conf files on the generating server: more iptables.log.conf source s_var_log_iptables.log { file("/var/log/iptables.log" program-override(var_log_iptables.log) flags(no-parse)); }; log { source(s_var_log_iptables.log); destination(d_midfin_logger_2); }; more midfin_logger_2.conf template t_sdx_tagged { template("$ISODATE $HOST $PROGRAM $MSG "); template_escape(no); }; destination d_midfin_logger_2 { tcp( "10.4.16.161" port(514) template(t_sdx_tagged)); }; What I am trying to do on the log host is to: 1. Segregate at the top level by host. For each such host: * Split the logs into different directories so that for example, I'll have one directory for the audit log from that host, another for iptables etc - so that under each host I'll have /var/log/iptables.log etc. I've been unable to grok the documentation to figure out quite how to do this and would really appreciate some help. thanks vk == ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq