[syslog-ng] Tailing a file

[maillists0 at gmail.com]

> This won't work because you're redefining the same source so the last
> definition wins. Either group all file() statements into a single
> source definition or create a unique source for every files. I prefer
> the former (otherwise a lot of extra log sections has to get created),
> so the source definition would look like
>
> source s_tailedfiles {
>  file("myfile1" follow_freq(1));
>  file("myfile2" follow_freq(1));
>  ...
> };
>
>
> Regards,
>
> Sandor

Thanks so much for the answer. Almost as soon as I sent this, I
realized I'd made a typo that wasn't enough to cause syslog-ng to
choke but did cause it to fail.

Now that it's working, sort of, I have another issue that I don't understand.

On the remote server, I have these stanzas:

options { sync (0);
          time_reopen (10);
          stats(43200);
          log_fifo_size (1000);
          long_hostnames (off);
          chain_hostnames (no);
          keep_hostname (yes);
          use_dns (yes);
          dns_cache (yes);
          use_fqdn (no);
          create_dirs (yes);
          dir_perm(0750);
          perm(0640);
          dir_group(1000);
        };

destination d_r_mesg { file("/data/$HOST/messages"); };
destination d_r_auth { file("/data/$HOST/secure"); };
destination d_r_mail { file("/data/$HOST/maillog"); };
destination d_r_spol { file("/data/$HOST/spooler"); };
destination d_r_boot { file("/data/$HOST/boot.log"); };
destination d_r_cron { file("/data/$HOST/cron"); };
destination d_r_kernel { file("/data/$HOST/kernel"); };

So right now, my application log messages are all going to
/data/$HOST/messages, but I need to keep the name of the original log
file and reproduce it on the remote server. So myfile1 would show up
as /data/$HOST/myfile1 on the remote server. Do I need to create a
macro on the client for that, and a corresponding destination on the
server?

Again, thanks for your help.