remote syslog to separate files

[Ratzie]

We are looking into setting up a separate syslog server. We have been able to push the syslogs to one server, but it is messy and unruly.
1. Can you set on on the host server to:
a) keep a copy of the syslog and...
b) also send it to the remote server.

2. Instead of the syslog treating all incoming messages as local, there for creating one huge syslog that contains multiple servers. I would like to set it up so they each have there own file.
server1.messages
server2.messages
etc.

Is there a pkg that can do all this.
We would like to incorporate windows and HP later on.

[Stuart Browne · Accepted solution]

Yes, 'syslog' can keep a copy locally as well as send to a remote server. Just create two lines in '/etc/syslog.conf' on the client server, one pointing to a @server, the other pointing to a file.

Now, as for separating on the server... not something I've done before..

From what I have read, syslog can't do this nativly. You could however set it to write out to a fifo (| /path/to/fifo), and set up a short perl routine to read from the fifo and split it out according to the server (open( FH, "/path/to/fifo);while () { ... }).

The 'syslog.conf' man page says what's needed for that option.

Other than that, I've not tried to do this, so am unaware of any other syslog based products that could do this for you.

[Kele_1]

what is your operating system?
this syslog server designed only for this purpose.
that case you can use syslog-ng (on linux) which can make seperated log files depends on the source host

[Ratzie]

You are right, it will be strictly a syslog server and will be installed on RedHat ES3.0, and I have narrowed it down to the syslog-ng.

I have not used it before and have a few questions regarding it.

Is this all server based, meaning, does all the work being done on the syslog-ng server?

I would like only to change the syslog.conf file on the other systems to send the syslog to the syslog-ng server.
This does not mean I need to install a different type of client on any other system?

Appreciate your help

[Gabor Kelecsenyi]

hali,

you only need to change the syslog.conf file on other systems. On syslog-ng site you have to change your standard syslog to syslog-ng. It has a different and more flexible syslog-ng.conf file.
in that file you can define destinations, filters and sources. depends on sources (network, hostname, ip etc) you can select destinations (ie files)

[Ratzie]

Thanks