[syslog-ng] How to manage the Syslog-NG messages coming from different sites? Each sites has their Syslog-NG clients?

[Clayton Dukes]

Hi Marcos,
Are you saying that the recieving server is not keeping the original
hostname?
If so, just use keep_hostname(yes); in your global options.


Here are my settings:
options {
      long_hostnames(off);
      # doesn't actually help on Solaris, log(3) truncates at 1024 chars
      log_msg_size(8192);
      # buffer just a little for performance
      flush_lines(1);
      # memory is cheap, buffer messages unable to write (like to loghost)
      log_fifo_size(16384);
      # The time to wait before a dead connection is reestablished (seconds)
      time_reopen(10);
      #Use DNS so that our good names are used, not hostnames
      use_dns(yes);
      dns_cache(yes);
      #Use the whole DNS name
      use_fqdn(yes);
      keep_hostname(yes);
      chain_hostnames(no);
      #Read permission for everyone
      perm(0644);
};




______________________________________________________________

Clayton Dukes
______________________________________________________________


On Wed, Aug 3, 2011 at 6:20 AM, Marcos Tang <marcostang2002 at yahoo.com>wrote:

> Hi,
>
> I have a problem to manage the Syslog-NG messages sending from different
> Syslog-NG clients at different remote sites.
>
> For example, I have 10 sites (site1, site2, site3 to site 10) running
> Syslog-NG clients. Each site has one Syslog-NG server and all the Syslog
> messages will be forwarded to the centralized Syslog-NG server and insert
> into the MySQL database at the headquarter finally.
>
> Now, I can see all the Syslog messages at the headquarter MySQL database;
> but it is hard for me to manage them.
>
> For example, if I know the hostname of a particular host, I can query the
> MySQL database to search for the Syslog related to that host. However, if I
> want to know the Syslog messages coming from a particular site such as
> "site1", how can I do that? There is no "site1" information inside the
> Syslog messages.
>
> I am thinking if I can modify the Syslog-NG configuration file such that I
> can add some information such as "site1" and make it as part of the Syslog
> messages, I can query the MySQL database for "site1" pattern. But I am not
> sure if I can do that or not.
>
> If you have any suggestions/ideas, please let me know that.
>
> Regards,
> Marcos
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110803/c29eb8f9/attachment.htm