Syslog-NG Format

fcompagnari · 08-15-2008, 11:33 AM

I am an administrator of a department and would like to have a single syslog file or rotated files rather than the many device files that syslog-NG creates as it is installed today. I feel there is a benefit in a single rolling file rather than having to "bring together" the multiple files, and I feel that it would be better received by auditors, security, etc. if I didn't have to "create a file" from multiple files. Can someone please provide some information on this topic, and can syslog-ng (which everyone seems to like) produce a single output file or should I use another syslog server application. Please advise.

jomen · 08-15-2008, 12:17 PM

That is all configurable.
I have two destinations:

Code:

destination messages { file("/var/log/messages"); };
destination console_all { file("/dev/tty12"); };

and two matching log statements:

Code:

log { source(src); destination(messages); };
log { source(src); destination(console_all); };

It all goes to /var/log/messages and also to tty12 (live-view)