Your best option is to split them up by hostname. Syslog has no understanding of differing platform types. Most of the cisco devices will log to the same facility/severity anyway, so hostname is your best bet. destination by_host { file("/var/syslog/$HOST"); }; - billn On Mon, 13 Sep 2004, Rex Petersen wrote:

Hi

Anyone who can show me how I split up the log files,

so each device has it's own log file.

Something like this:

Devices:

Cisco 3550-12G Switch: cisco3550-12.log

Cisco 3548XL Switch #1: cisco3548_1.log

Cisco 3548XL Switch #2: cisco3548_2.log

Cisco PIX 515UR Firewall: cisco_515.log

VPN3005 Concentrator: cisco_3005.log

Best regards

Rex Petersen