[syslog-ng]logging to a central server

[Chad C. Walstrom]

On Mon, Jan 07, 2002 at 06:36:02PM -0500, Ed Ravin wrote:
> Over at the central server, you need to define the source:
> 
>    source src {
>            tcp(port(NNN) max-connections(500));
>            internal();
>    };
> 
> You might want to put in other sources, such as local syslog
> messages or kernel messages.  See the documentation for more
> description of the source and destination directives.

I usually separate the net sources from the local:

    source net {
        tcp(port...
    };

That way, I can have special rules for host-specific logs while still keeping
my standard local loggin setup for the central server itself.

-- 
Chad Walstrom <chewie@wookimus.net>                 | a.k.a. ^chewie
http://www.wookimus.net/                            | s.k.a. gunnarr
Get my public key, ICQ#, etc.  Send email w/the Subject: "get help"