On Tue, Aug 09, 2005 at 01:11:17PM -0400, Damien_DeVille@discovery.com wrote:
I'm in a position where I've got a device that uses syslog-ng to filter multiple events into multiple diferent log files. I need to send the logs to a central udp syslog server and would like to have all events from this particular device show up as coming from a specific facility (say local3) so that they get put into the correct logfile on the central server. I've figured out that I have to define a destination, filter, and log in syslog-ng.conf but I haven't figured out how to mark all the logs to that destination with a specific facility. Is that possible?
Don't change the facility/severity information, just send to a specific port on the central server. On the central server make everything coming in on that port it's own source, then decide what to do with it from there with filters of your choice. -- Nate "You are trapped in a maze of screens and ssh sessions all alike." "It is dark, and you are likely to log off the wrong account."