LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
LinkBack Search this Thread
Old 06-14-2005, 10:56 AM   #1
XaViaR
Member
 
Registered: Dec 2004
Distribution: RHEL, CentOS, SuSE
Posts: 170

Rep: Reputation: 30
syslog vs syslog-ng


Hello,

I am trying to create a syslog server. I am using SLES 9.0, and I would like create a syslog server that accepts incoming syslogs; however, I would like them appended to their own folder. For example, if 192.168.1.1 is my syslog server, and 192.168.1.5 is a client. I would like to write 192.168.1.5 logs to 192.168.1.1 --> to the following directory: /var/log/syslog/192.168.1.5/{all the logs go here}

My question to you is how do I do this?? :-) Is syslog able to do this? Or is this just a feature within syslog-ng?

-X

If my example is not clear, please post and I will verify any questions. Thanks!!
 
Old 06-14-2005, 12:35 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,344

Rep: Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945
looks pretty simple:

http://sial.org/howto/logging/syslog-ng/

just use $HOST in the destination name.

(please try to reply to posts if they help you btw... it's only polite)
 
Old 06-14-2005, 12:56 PM   #3
daly1
Member
 
Registered: May 2005
Distribution: gentoo ROCKS
Posts: 32

Rep: Reputation: 15
Nope, that is something only available with syslog-ng.
 
Old 06-14-2005, 02:44 PM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,344

Rep: Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945
hmm.. helps to fully read the question. yeah .. syslog-ng only. that's what's so -ng'y about it.
 
Old 06-14-2005, 08:17 PM   #5
daly1
Member
 
Registered: May 2005
Distribution: gentoo ROCKS
Posts: 32

Rep: Reputation: 15
acid_kewpie, I did read it. I was answering, got called into a meeting, came back, pressed post, the page refreshed, I saw your post, felt silly, then you made it even worse LOL
 
Old 06-15-2005, 08:46 AM   #6
XaViaR
Member
 
Registered: Dec 2004
Distribution: RHEL, CentOS, SuSE
Posts: 170

Original Poster
Rep: Reputation: 30
Thank you for all your help!!! :-) I will post a replay once I get everything working!
 
Old 06-15-2005, 11:42 AM   #7
XaViaR
Member
 
Registered: Dec 2004
Distribution: RHEL, CentOS, SuSE
Posts: 170

Original Poster
Rep: Reputation: 30
Do you think that you can paste your syslog-ng.conf.ini file, so I can see where exactly to add $HOST.

Thanks,
 
Old 06-16-2005, 03:53 PM   #8
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,344

Rep: Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945
i've never done it myself, but that link gives all the exmaples you'd need, e.g.
Code:
destination messages {
file("/var/log/archive/messages/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY"
template("$ISODATE <$FACILITY.$PRIORITY> $HOST $MSG\n")
template_escape(no)
);
};
 
Old 06-16-2005, 04:28 PM   #9
oneandoneis2
Senior Member
 
Registered: Nov 2003
Location: West Sussex, England
Distribution: Gentoo
Posts: 1,457

Rep: Reputation: 45
I never got on with syslog-ng. I found metalog a lot easier to configure.
 
Old 06-17-2005, 09:15 AM   #10
XaViaR
Member
 
Registered: Dec 2004
Distribution: RHEL, CentOS, SuSE
Posts: 170

Original Poster
Rep: Reputation: 30
Thank you for all of your help! :-)

Below is how I installed and configured syslog-ng to run under SLES 9.0...

1. I installed syslog-ng from Yast, and installed updates.
2. I downloaded the syslog-ng "expanded sample syslog-ng conf file" from http://www.campin.net/syslog-ng/expanded-syslog-ng.conf
3. I replaced /etc/syslog-ng/syslog-ng.conf with the "expanded sample syslog-ng conf file."
4. By default, the expanded syslog-ng file uses tcp on port 4800. However, if you would like to change it to use upd on port 514. Then replace this lines:
source s_tcp
{ tcp(port(4800) keep-alive(yes) max_connections(100)); };

with this line:
source s_udp
{ udp(port(514)); };
5. Search the syslog-ng file for s_tcp and replace ALL of them with s_udp (except the commented ones) :-)
6. Edit /etc/sysconfig/syslog and change the following line to read: SYSLOG_DAEMON="syslog-ng"
7. Restart the service!

I hope this helps someone! :-)

-X

P.S.
Thanks again for all your help!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
what does this mean in my syslog? rosscopeeko Mandriva 4 06-04-2004 02:50 PM
syslog -r dvong3 Linux - General 5 12-27-2003 07:22 AM
Syslog??? pk21 Programming 3 07-05-2002 07:25 AM
syslog buttnutt Linux - General 1 06-11-2002 08:56 PM
Syslog ltrain Linux - General 3 06-27-2001 03:43 PM


All times are GMT -5. The time now is 09:13 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration