Hi all,

I'm trying to set up a syslog-ng 2.0.0 on Red Hat Enterprise 4.0 i386 edition.

I have already set up my /etc/syslog-ng.conf file in following way:

[root@swlogg02 cisco]# cat /etc/syslog-ng.conf
# syslog-ng configuration file.
#
# This should behave pretty much like the original syslog on RedHat. But
# it could be configured a lot smarter.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
#

options {
        sync (0);
        time_reopen (10);
        log_fifo_size (1000);
        long_hostnames (off);
        use_dns (no);
        use_fqdn (no);
        create_dirs (yes);
        keep_hostname (yes);
};

source s_cisco {
udp(ip(0.0.0.0) port(514));
};

destination d_cisco_d { file("/var/log/cisco/$HOST/$YEAR/$MONTH/$DAY/log"); };
destination d_cisco_c { file("/var/log/cisco/$HOST/$YEAR/$MONTH/$DAY/log"); };

filter f_cisco_d { level(debug); };
filter f_cisco_c { level(crit); };

log { source(s_cisco); filter(f_cisco_d); destination(d_cisco_d); };
log { source(s_cisco); filter(f_cisco_c); destination(d_cisco_c); };

but I only got logs from only one machine, for your information from ASA5520. I would liek to receive messages from almost 50 machines (routers/switches/firewalls, etc). As general I set up on firewalls critical level of logging and on router/switches debug.

Could you please tell me what I did wrong?

regards

Michał Rębelski