0

Scenario is to receive all incoming messages and store all of those messages in /app/syslog-ng/custom/output/all_devices.log, but forward only certain messages(by filtering).

filter tag is used to filter incoming messages to Syslog-NG, which is not the right usage, in this scenario. For example: filter f_warn { level(warn); };


Edit:

My current configuration is:

@version: 3.17

source s_network {
        udp(
                flags(syslog_protocol)
                keep_hostname(yes)
                keep_timestamp(yes)
                use_dns(no)
                use_fqdn(no)
        );
};

destination d_all_logs {
        file("/app/syslog-ng/custom/output/all_devices.log");

};

log {
        source(s_network);
        destination(d_all_logs);
};

After storing all messages in all_devices.log, Does Syslog-NG provide syntax(configuration) to forward only certain messages(after filtering) to remote log server?

1

You can combine multiple directives in your configuration file.

As an example, based on your code, you define a filter:

filter f_warn { level(warn); };

then a destination:

destination remote_log_server {
 udp("192.168.0.20" port(25214));
};

and put them all together with something like:

log { source(src); filter(f_warn); destination(remote_log_server); };

Obviously, you have to configure your source, filter and destination based on your needs.

I suggest you take a good read at the official manual, as there are lots of options to customize your logging.

  • Perhaps also take a look at rsyslog as an alternative to syslog-ng – wurtel Sep 6 '18 at 19:53
  • Does filter tag not stop rest of incoming messages to syslog-ng? Because we want all messages to be stored in local file... – overexchange Sep 7 '18 at 1:10
  • 1
    No, because by default every log path receives every message of the source. (You can use the flags(final) option to change this, see syslog-ng.com/technical-documents/doc/… and syslog-ng.com/technical-documents/doc/…) – Robert Fekete Sep 7 '18 at 7:19
  • @RobertFekete I mean, Do I need to add one more log statement, to my existing configuration? Given in query... – overexchange Sep 7 '18 at 9:56
  • 2
    Yes, so you'll have two, like: log { source(src); destination(local_file); }; log { source(src); filter(f_warn) destination(remote_log_server); }; – Robert Fekete Sep 7 '18 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.