Konstantin Riabitsev writes:

... Say, I have Solaris boxes and Linux boxes on my network, and I want them all to log to one loghost. However, I would like to separate the incoming logs by system type. I had this idea: Solaris boxes would log to log-sol.domain.com, while Linux boxes would log to log-lnx.domain.com, which are both CNAME's to loghost.domain.com.

Instead of CNAMEs, make them separate virtual IP numbers on the same box. Then set up separate sources in syslog-ng to listen on the seperate IP addresses, and since they are in separate streams, you can do whatever you like with them. For example: source linuxlogs { tcp(ip(192.168.1.10) port(1999); ); }; source solarislogs { tcp(ip(192.168.1.99) port(1999); ); };

Would it be possible for syslog-ng to put all solaris logs in /var/log/solaris and linux logs into /var/log/linux, based entirely on which hostname they arrived at?

The traffic is sent by IP number, not hostname, which is why you'd have to use separate IP addresses. You should be able to filter on the source hostname, since you know in advance which parts of your network are Linux and which parts are Solaris, but I think my way is cleaner. -- Ed