[syslog-ng] Forwarding flat files to a remote syslog-ng server

[Scheidler, Balázs]

Hi,


Couple of notes:

* When reading messages from a file, you are using flags(no-parse) which
means that you will not have facility information. I dont see that you need
the filter at all, as you are using dedicated destinations. I think that
filter can be removed.
* you dont need separate destinations to each file, just use one
destination and connect both sources to it
* If you run syslog-ng in foreground and enable debug mode it emits
information about messages entering and leaving
* 3.6 is ancient, not to mention 2.0.9, you should probably upgrade

On May 22, 2018 04:08, "Song, Young" <young.song at sap.com> wrote:

>
>
>
>
> Hi,
>
>
>
>
>
> I’m trying to send various flat files to a central syslog-ng server.
>
>
>
> So, I have the following setups but somehow using the “local1” and
> “local2” facilities don’t work, although no errors when restarting syslog
> services on both client & server.
>
>
>
> Any advice would be appreciated much!
>
>
>
>
>
> =======================================================================
>
>
>
> *My syslog-ng CLIENT (running syslog-ng 3.6.2):*
>
>
>
> source s_file1 { file("/var/log/syslog/file1.log" follow-freq(1)
> flags(no-parse) program_override("audit")); };
>
> filter f_file1 { facility(local1); };
>
> destination d_file1 { syslog("10.10.10.10" transport("udp") port(514)); };
>
> log { source(s_file1); filter(f_file1); destination(d_file1); };
>
>
>
> source s_file2 { file("/var/log/syslog/file2.log" follow-freq(1)
> flags(no-parse) program_override("audit")); };
>
> filter f_file2 { facility(local2); };
>
> destination d_file2 { syslog("10.10.10.10" transport("udp") port(514)); };
>
> log { source(s_file2); filter(f_file2); destination(d_file2); };
>
>
>
>
>
> ========================================================================
>
>
>
> *My syslog-ng SERVER (10.10.10.10 – running syslog-ng 2.0.9):*
>
>
>
> destination d_file1 { file ("/var/log/syslogs/file1-$YEAR$MONTH$DAY.log"
> owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); };
>
> filter f_file1 { facility(local1); };
>
> log { source(remote); filter(f_file1); destination(d_file1); };
>
>
>
> destination d_file2 { file ("/var/log/syslogs/file2-$YEAR$MONTH$DAY.log"
> owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); };
>
> filter f_file2 { facility(local2); };
>
> log { source(remote); filter(f_file2); destination(d_file2); };
>
>
>
>
>
> Thanks.
>
>
>
>
>
> -  Young
>
>
>
>
>
>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180522/229bad02/attachment.html>