Seems a bit of a hack. Why don't you file all log messages by hostname, and when you parse the messages with your scripts, associate the host name with an os? A perl hash, to me, would seem to be a natural way to solve this... Wayne Sweatt wrote:

I was interested in running 2-3 instances of Syslog-ng on a single system, with a single interface. I would use different port numbers for each, of course. The reason was to separate logs from different client OS types. We have a different team that supports Mac OS X, for example, and would like to keep a separate directory tree of logs for those systems. The syslog-ng.conf file would be pushed out to the different *NIX Oses with Cfengine, and then Syslog-ng could keep the logs separate and then could be parsed those logs with my scripts and email the appropriate admins. Is the running 2-3 concurrent instances ok?

Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html