RHEL 5.4
i want to be able to do redistribution of inbound syslog messages to syslogd. as example, my syslog.conf has in it at the end:

*.* @192.168.5.5
*.* @192.168.5.6

my sysconfig/syslog file has "-r" as the only option for syslogd.

any messages generated by the localhost will be sent to the two remote servers, but messages that come into this box (udp 514) only get logged locally and do not get sent out to the remote hosts.

you may ask why do i want to do this. because i have several syslog servers (for security purposes) and many of my net devices are configured to send syslog to all the syslog servers, hence each device is sending way too much duplicate udp-514. so i would like to minimize the udp-514 coming out of the devices, have all devices send to a central syslog server, and then central syslog server do distribution to the other syslog servers. others have also called this "syslog proxy". or, if not with syslogd, how to achieve this (preserving the original syslog message host info, etc)?

is this possible with syslogd or syslog-ng or rsyslog?

thnx

Hi,

Youi could look at using the 'netdump' package to do this as well. We have a number of rhel 4.7 and 5.3 hosts which installed the netdump package on, and rather than using the vmcore dump facility we just used the syslog facility.

Look at http://kbase.redhat.com/faq/docs/DOC-6913 for more info.

HTH

STuart.