On Thu, 31 Mar 2005, Ryan McCain wrote:

source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix_stream("/dev/log"); internal(); };

destination hosts { file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); };

log { source(s_sys); destination(hosts); };

Yup. Should work like a champ. It's very similiar to a larger deployment I'm using. - billn