[syslog-ng]Splitting routerlogs from servers

[Michael Renner]

Hiya!

I've got a setup like this with many log hosts (~200, raising) and want to 
split the server logfiles from those of our routers. i've got a setup like 
this:

---

options { sync (0);
           log_fifo_size (1000);
           use_fqdn (yes);
           chain_hostnames(no);
           stats (86400);
         };

source src { unix-stream("/dev/log"); internal(); };
source net { udp(ip(0.0.0.0) port(514)); };
source srck { pipe("/proc/kmsg"); };

destination messages    { file("/var/log/local/$YEAR-$MONTH-$DAY" 
create_dirs(yes)); };
destination router      { file("/var/log/router/$HOST/$YEAR-$MONTH-$DAY" 
create_dirs(yes)); };
destination server      { file("/var/log/server/$HOST/$YEAR-$MONTH-$DAY" 
create_dirs(yes)); };
destination unknown     { file("/var/log/unknown/$HOST/$YEAR-$MONTH-$DAY" 
create_dirs(yes)); };

filter f_router         { 
facility(local1,local2,local3,local4,local5,local6,local7); };

filter f_server         { host("server1|server2|serverx|..."); };


log { source(src); source(srck); destination(messages); flags(final); };
log { source(net); filter(f_server); destination(server); flags(final); };
log { source(net); filter(f_router); destination(router); };
log { source(net); destination(unknown); flags(fallback); };

---

This is a very ugly setup because i always have to add new servers to the 
f_server filter, otherwise it would get logged in the router/unknown dir

Is there a better way to solve this with one ip address or should i add a 
secondary interface to the server and let the routers log to the second ip?


mfg

-- 

Renner Michael
Junior System Engineer

Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at
support@inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699