[syslog-ng] lazy logger++

Alexander Clouter ac56 at soas.ac.uk
Thu Oct 19 11:25:38 CEST 2006


Hi,

This is probably the last thing you care about during the release candidate 
phase but a single bit of extra functionality would be greatly useful for 
those using the multicast logging feature.

What I am planning on doing is having something like the following in my 
syslog-ng.conf file which is fantastic as to add logging groups I just add 
extra udp() lines to s_multicastGeneric and nothing else is needed.  At the 
moment I would need separate source/destination/log entries per multicast 
group address, which is upsetting and results in a hideous configuration 
file.

====================
source s_multicastGeneric {
        ## squid
        # access
        udp(ip(239.194.251.0) port(514));
        # cache
        udp(ip(239.194.251.32) port(514));
};

destination df_multicastGeneric {
        file("/var/log/syslog-ng/mulitcastGeneric/$DESTIP/$R_YEAR$R_MONTH$R_DAY.log");
};

log {
       source(s_multicastGeneric);
       destination(df_multicastGeneric);
       flags(final);
};
====================

I have actually had a go at patching syslog-ng to do this, however my 
patching effort is getting out of control.  My method is to add the 
IP_PKTINFO (or IP_RECVDSTADDR) socket option to the multicast receive section 
in afinet_setup_socket() but thats about as far as I have gotten.

I'm still working on trying to produce a patch myself but I am hoping someone 
on this list might have a better idea on how to cleanly get the information 
needed for $DESTIP to function from macros.c without doing anything major to 
the sourcecode.

Whilst I am in my 'moon-on-a-stick' request list, a $HOST_TO in addition to 
$DESTIP would be handy too. :)

As I said, I'm working on a patch at my end and will post it here once done, 
but its unlikely to be pretty... :)

Cheers

Alex


More information about the syslog-ng mailing list