Dotaz: Syslog-ng

[iKoulee]

Mam trochu problem se syslog-ng (asi neumim cist dokumentaci) ma s tim nekdo zkusenosti?

Popis:

mam stroj s apachem, na kterem loguji skrze logger do syslogu

CustomLog "|/usr/bin/logger -t 'foo' -p info -u /var/run/apache2/log.socket" Combined env=!skip_log

Tagovanim rozlisuju ruzne virtualhosty, tak jak by se mely logovat spolu ci oddelene (alespon takova je idea).

Na clientovi mam pak nasledujici konfiguraci syslogu:

source s_apache {
        unix-stream("/var/run/apache2/log.socket");
};
destination tjener_syslog-ng {
        tcp( "192.168.0.1" port(514) );
};
log {
        source(s_all);
        source(s_apache);
        destination(tjener_syslog-ng);
};

Na serveru pak:

## Sources
source s_clients {
        tcp(ip(0.0.0.0) port(514) max_connections(1000));
};

## Destinations
destination d_host_facility {
        file("/var/log/remote/clients/$HOST/$FACILITY.log");
};
destination d_host_apache_foo1 {
        file("/var/log/remote/clients/$HOST/foo1.access.log");
};
destination d_host_apache_foo2 {
        file("/var/log/remote/clients/$HOST/foo2.access.log");
};

## Filters
filter f_std_facility {
        facility(auth, authpriv, cron, daemon, kern, lpr, local0,
        local1, local3, local4 local5, local6, local7, mail, news, uucp);
};

filter f_apache_foo1 {
        match("foo1" value("MESSAGE"));
};
filter f_apache_foo2 {
        match("foo2" value("MESSAGE"));
};


## Logs
log {
        source(s_clients);
        source(s_src);
        filter(f_std_facility);
        destination(d_host_facility);
};

log {
        source(s_clients);
        filter(f_apache_foo1);
        destination(d_host_apache_foo1);
};

log {
        source(s_clients);
        filter(f_apache_foo2);
        destination(d_host_apache_foo2);
};

A problem mam v tom, ze se mi nedari match ve filtru. Tusite tedy nekdo jak na to? Zkousel jsem pouzit i tags("foo1"); ve filtru, ale taky bez efektu, bud mi neprojde nic a nebo vsechno.

---

---

Odpovědi

[iKoulee]

OK, tak pomohlo precist si ten manual jeste jednou a pomalu

vsechno resi direktiva/funkce

program("string")

A nejvetsi cast problemu byla mezi zidli a klavesnici a trochu v nekompatibilite manualu, protoze TAG bylo oznaceno neco co syslong-ng nazyva PROGRAM