[syslog-ng] Load balancing using $SEC

[Vincent Panel]

Hi,

I'm trying to do some kind of load-balancing using syslog-ng. I'm willing to write to 2 different files named "syslog1" and "syslog2". The first one would get all messages received by syslog whose timestamp have a second ending with 0, 1, 2, 3 or 4. Syslog 2 would get all messages whose second ends with 5, 6, 7, 8 or 9.

For instance, if I get those messages :
Feb 27 00:00:03 blabla1
Feb 27 00:00:04 blabla2
Feb 27 00:00:05 blabla3
Feb 27 00:00:06 blabla4

The first two messages would end up in syslog1 and the last 2 messages would end up in syslog2

However, I was not able to do this because :
* filtering is not possible on any date-related macro (I don't know why, but only MSG and MSGHDR macros seem populated at that point in time)
* I can't apply a rewrite rule on $SEC
* I can't apply any function to the $SEC macro in the destination statement, or I don't know how to do it

Do you think it's still possible to achieve what I want with syslog-ng ?

Vincent
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090227/408eb4b7/attachment.htm