[syslog-ng]A few questions

[Keith Olmstead]

Hello,

I have been messing with syslog-ng for awhile now. and I have it working on a central log server that I am working on, and now I have a few questions.

1.  Is it better to do the filtering on the remote log server or the syslog server?  I would think sending all logs to the syslog server would create uneeded traffic.

2.  I am logging using the following variables, but it seems that the log is only getting logged as message_$date in the dir.  Why is this?
/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH_$DAY"

TIA,

Keith Olmstead