[syslog-ng] specify destination filename in message?

[Alexander Clouter]

Hi,

Robert Ulbrich <rulbrich at capsher.com> [20080507 13:19:52 -0500]:
>
> 
> >
> > That's the solution you've picked.
> >   
>
> I still haven't figured out how to actually do this in the configuration 
> file.
> 
> > What is the reasoning which lead you to pick this solution?
> >   
> I am going to be using syslog to log messages from an app I am writing. I 
> need to be able to have the messages start going into a new file at an 
> arbitrary time.
>
This is what I was prodding you towards for an answer in my last email :)

The solution is probably to use the bits available to you in a syslog header.

http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch02s10.html

Severity and Facility should give you anything you need?  If you need more 
than that I would recommend you either:
 * send out your syslog messages on a multicast address
 * open more ports your syslog server listens on and log different for each 
	one, alternatively assign multiple IP's to your syslog server to do 
	the same thing if you have to use 514/udp for all messages

When you say 'arbitrary time', what prompts you system to change?  More 
details and we might be able to suggest an idea system for you.

Cheers

Alex