I can't get syslog to work in logging to a remote machine. I have a linux (centos4) client machine at nottingham which I'll call nottingham.com and another duplicate machine in derby which I'll call derby.com. The machine at nottingham creates a mail log in /var/log/ and I want to duplicate this log on the derby machine. I've tried loads of different configs in syslog.conf but nothing works. How do I tell the nottingham machine to send a duplicate of just the mail log and how do I tell the derby machine to log it? I've googled several pages about this but I can't get it to work. I've watched the derby.com machine in wireshark and I can see it receiving syslog stuff from the nottingham machine but nothing appears in the derby.com log.

Have you changed the startup options in /etc/sysconfig/syslog on derby.com ?

yes, I've made some progress. I can get the remote machine logging to the server machine but the logs are mixed together. I specifically want to send the mail log of the nottingham machine, it's sending the data fine but it's mixed up with the mail log of the derby machine. I'd like to keep it seperate but there seems no way to do that that I can see...

You might need to move to syslog-ng on the central server, it will expand $HOST to generate host specific log file destinations.