I have a remote syslog server which is recieving messages from many hosts. I would like it to log them in seperate files denoted by hostname . For example all messages for host1 in a directory of the same name. Is there an easy way to do this using syslogd? I have a feeling syslog-ng provides this sort of capability but I would like to stick with regular syslogd if possible.
many thanks
Not with syslogd - syslog-ng is the way to go - we perform similar logging in our environment.
Cheers
ZB
Not sure if this helps at all, but we use the Parse::Syslog perl module to normalize everything that comes in; we then load it into a database for referencing (Postgres, but any database should work).
From the documentation: Parse::Syslog - Parse Unix syslog files - metacpan.org
my $parser = Parse::Syslog->new( '/var/log/syslog', year => 2001);
while(my $sl = $parser->next) {
... access $sl->{timestamp|host|program|pid|text} ...
}
Many thanks for the help (apologies for the delayed response). I think I will go with syslogd option. I have drafted a syslog-ng.conf file but I am not getting the logs I would expect.
At present I have approx 10 clients which are using syslogd - I have centralised syslog server which is now using syslog-ng. In each client I have line in the syslog.conf file which sends everthing to the central server like this
*.* @loghost
loghost is defined in /etc/hosts and prior to switching to syslog-ng logs were sent as expected to loghost. Now I dont see any evidence of remote logs on the syslog server. I even configured 1 client with syslog-ng and switched to tcp but still nothing
On the server the syslog-ng.conf looks like this
options { sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (yes);
keep_hostname (yes);
};
#source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); };
source s_remote {udp(); };
source s_sys{ internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); };
destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog"); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_mlal { usertty("*"); };
destination d_kernel { file("/var/log/kern.log"); };
destination d_clients { file("/var/log/HOSTS/$HOST/"); };
filter f_filter1 { facility(kern); };
filter f_filter2 { level(info) and
not (facility(mail)
or facility(authpriv)
or facility(cron)
or program("kernel")); };
filter f_filter3 { facility(authpriv); };
filter f_filter4 { facility(mail); };
filter f_filter5 { level(emerg); };
filter f_filter6 { facility(uucp) or
(facility(news) and level(crit)); };
filter f_filter7 { facility(local7); };
filter f_filter8 { facility(cron); };
filter f_kernel { level(info) and program("kernel"); };
log { source(s_sys); filter(f_filter1); destination(d_cons); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_auth); };
log { source(s_sys); filter(f_filter4); destination(d_mail); };
log { source(s_sys); filter(f_filter5); destination(d_mlal); };
log { source(s_sys); filter(f_filter6); destination(d_spol); };
log { source(s_sys); filter(f_filter7); destination(d_boot); };
log { source(s_sys); filter(f_filter8); destination(d_cron); };
log { source(s_sys); filter(f_kernel); destination(d_kernel); };
log { source(s_remote); destination(d_clients); };
# vim: syntax=syslog-ng
the client config looks like this
options { sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};
source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); };
destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog"); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_mlal { usertty("*"); };
destination d_kernel { file("/var/log/kern.log"); };
destination d_loghost {udp("loghost" port(514));};
filter f_filter1 { facility(kern); };
filter f_filter2 { level(info) and
not (facility(mail)
or facility(authpriv)
or facility(cron)
or program("kernel")); };
filter f_filter3 { facility(authpriv); };
filter f_filter4 { facility(mail); };
filter f_filter5 { level(emerg); };
filter f_filter6 { facility(uucp) or
(facility(news) and level(crit)); };
filter f_filter7 { facility(local7); };
filter f_filter8 { facility(cron); };
filter f_kernel { level(info) and program("kernel"); };
#log { source(s_sys); filter(f_filter1); destination(d_cons); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_auth); };
log { source(s_sys); filter(f_filter4); destination(d_mail); };
log { source(s_sys); filter(f_filter5); destination(d_mlal); };
log { source(s_sys); filter(f_filter6); destination(d_spol); };
log { source(s_sys); filter(f_filter7); destination(d_boot); };
log { source(s_sys); filter(f_filter8); destination(d_cron); };
log { source(s_sys); filter(f_kernel); destination(d_kernel); };
log { source(s_sys); destination(d_loghost); };
so far I am not seeing any remote or local logs - any pointers ??
Cheers