[syslog-ng]separate logs from different sources

[Hamilton, Andrew]

And of course you really don't need to have the filter statement in it at
all if you use the $HOST macro.

you could then just use:

source net { tcp(); udp(); };
destination hostfile { file("/path/to/logs/$HOST"); };
log { source(net); destination(hostfile); };

Drew
-----Original Message-----
From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil]
Sent: Monday, October 21, 2002 8:56 AM
To: syslog-ng@lists.balabit.hu
Subject: RE: [syslog-ng]separate logs from different sources


Olav,

This should work for you.  Of course you should substitute real names where
I have placed the x's and the filter and destination names should be
meaningful names.  Whether you use TCP is up to you.  You will need to use
UDP because that is how Cisco routers send their logs.

source net { tcp(); udp(); };
filter f_host { host("xxx.xxx.xxx.xxx"); };
destination hostfile { file("/path/to/logs/$HOST"); };
log { source(net); filter(f_host); destination(hostfile); };

Regards,

Drew
-----Original Message-----
From: Olav Langeland [mailto:Olav.Langeland@activeisp.com]
Sent: Monday, October 21, 2002 8:47 AM
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng]separate logs from different sources


I want to send syslog from 3 different Cisco routers to a FreeBSD box
and have syslog-ng separate them into different output files based on
IP. Would appreciate if anyone could help me with configuration
examples/ideas.

thanks, olav.

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html