Hi, Robert Ulbrich <rulbrich@capsher.com> [20080507 13:19:52 -0500]:
That's the solution you've picked.
I still haven't figured out how to actually do this in the configuration file.
What is the reasoning which lead you to pick this solution?
I am going to be using syslog to log messages from an app I am writing. I need to be able to have the messages start going into a new file at an arbitrary time.
This is what I was prodding you towards for an answer in my last email :) The solution is probably to use the bits available to you in a syslog header. http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch02s10.html Severity and Facility should give you anything you need? If you need more than that I would recommend you either: * send out your syslog messages on a multicast address * open more ports your syslog server listens on and log different for each one, alternatively assign multiple IP's to your syslog server to do the same thing if you have to use 514/udp for all messages When you say 'arbitrary time', what prompts you system to change? More details and we might be able to suggest an idea system for you. Cheers Alex