Hot answers tagged syslog-ng
3
This is done via templates, like this:
$template HostDynFile,"/var/log/HOSTS/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/%syslogfacility-text%_%HOSTNAME%_%$YEAR%_%$MONTH%_%$DAY%"
This template can then be used when defining an output selector line, e.g.:
*.* -?HostDynFile
More info is available here: Building A Central Loghost On CentOS And RHEL 5 With rsyslog
2
How can I extend this excluding rule to filter only those lines that contain: "DST=192.168.202.255" AND uses "udp" AND "PFILTER-DROP"?
Use something like:
filter demo_filter { program("PFILTER-DROP") and match("DST=192.168.202.255") and match("PROTO=UDP"); };
1
From the Documentation (my boldface):
Match a regular expression to the headers and the message itself (i.e., the values returned by the MSGHDR and MSG macros).
Match a regular expression to the text of the log message, excluding the headers (i.e., the value returned by the MSG macros).
1
BEFORE:
SERVER:/etc/syslog-ng # tail -3 syslog-ng.conf
#
#
log { source(src); destination(/var/log/messages); };
SERVER:/etc/syslog-ng #
EDIT THE syslog-ng.conf FILE:
vi /etc/syslog-ng/syslog-ng.conf
AFTER:
SERVER:/etc/syslog-ng # tail -3 syslog-ng.conf
#log { source(src); destination(/var/log/messages); };
filter heartbeat_filter { not ...
1
Three notes:
you should use a current git snapshot instead of alpha1, as alpha1 crashes on start-up.
please ask on the syslog-ng mailing list, as there are more people to answer your question, including syslog-ng developers.
even current git needs a patch, see this thread on the mailing list: 3.4 on opensuse factory
1
Recent Fedora versions ship with systemd. There you could change to syslog-ng using the following commands:
yum install syslog-ng
systemctl disable rsyslog.service
systemctl enable syslog-ng.service
systemctl stop rsyslog.service
systemctl start syslog-ng.service
At the end probably also remove rsyslog with rpm -e rsyslog.
Only top voted, non community-wiki answers of a minimum length are eligible
