LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 10-18-2011, 03:52 PM   #1
Rahil Parikh
LQ Newbie
 
Registered: Nov 2010
Posts: 15

Rep: Reputation: 0
Syslog-ng :: Filter internal logs


Hi,

I am trying to setup a test lab where there will be two syslog-ng (v2) servers. Each is sending it's own logs (host specific + internal syslog-ng) logs to the other syslog server.

How can receiving host identify if it's a normal log or syslog-ng internal log?

Thanks for help!
 
Old 10-19-2011, 06:24 AM   #2
Reuti
Senior Member
 
Registered: Dec 2004
Location: Marburg, Germany
Distribution: openSUSE 11.4
Posts: 1,319

Rep: Reputation: 252Reputation: 252Reputation: 252
What do you mean by “normal log”? You could define separate sources for the local logs and the ones received via network.
 
Old 10-19-2011, 09:06 AM   #3
Rahil Parikh
LQ Newbie
 
Registered: Nov 2010
Posts: 15

Original Poster
Rep: Reputation: 0
Thanks for reply! Sorry if I was not clear at first.

What I meant was --

SERVER1 will send its own syslog-ng's internal logs ( i.e. logs generated by syslog-ng daemon ) to SERVER2 in addition to normal logs ( i.e. logs under /var/log ). I want SERVER2 to be able to distinguish between SERVER1's internal logs and other logs from that system.

I hope this will help.

Thanks!
 
Old 10-19-2011, 09:12 AM   #4
Reuti
Senior Member
 
Registered: Dec 2004
Location: Marburg, Germany
Distribution: openSUSE 11.4
Posts: 1,319

Rep: Reputation: 252Reputation: 252Reputation: 252
Donít enable udp in the normal source src {...}; statement, but make an extra one like:
Code:
source foobar {
        udp(ip("192.168.123.123") port(514));
};
Then you can use this source for the log statements.
 
Old 10-19-2011, 09:23 AM   #5
Rahil Parikh
LQ Newbie
 
Registered: Nov 2010
Posts: 15

Original Poster
Rep: Reputation: 0
Thanks Reuti! But, SERVER1 will send all other types of log ( i.e. auth, kern, cron etc... ) as well as messages generated by driver 'internal()'. That's why I don't know how to distinguish between other/normal logs and 'internal' logs.
 
Old 10-19-2011, 10:08 AM   #6
ptrivino
Member
 
Registered: May 2008
Location: San Diego CA
Distribution: CentOS
Posts: 34

Rep: Reputation: 5
Perhaps "tag" the logs leaving Server1?
 
Old 10-19-2011, 10:30 AM   #7
Reuti
Senior Member
 
Registered: Dec 2004
Location: Marburg, Germany
Distribution: openSUSE 11.4
Posts: 1,319

Rep: Reputation: 252Reputation: 252Reputation: 252
The internally generated ones are the ones with the program name syslog-ng for which you can define a filter, and the “-- MARK --” entries. You could also define two sources at SERVER1 and route them to two different ports at the destination.
 
Old 10-21-2011, 10:08 AM   #8
Rahil Parikh
LQ Newbie
 
Registered: Nov 2010
Posts: 15

Original Poster
Rep: Reputation: 0
Thanks for replies! I think I will be using some special port for syslog-ng internal() messages.
 
  


Reply

Tags
internal, loadbalancing, logging, syslog-ng


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
syslog-ng filter JonDoe Linux - Server 8 10-19-2011 04:24 AM
Filter syslog razzera Debian 3 01-17-2011 04:43 PM
How to filter in syslog output LinuxLover Solaris / OpenSolaris 1 05-17-2010 01:12 PM
How to filter PA/module-alsa-sink.c messages from syslog sixerjman Linux - Software 2 05-05-2009 09:06 AM
Guarddog logs in syslog short101 Linux - Security 3 01-06-2005 01:31 AM


All times are GMT -5. The time now is 09:23 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration