syslog.conf logging to remote host

[johnwright007]

Hi all,

I'm currently editing one of our syslog.conf files to send messages of a certain nature to another machine on our network. I have done this but I'm not entirely sure what to do next.

The logs entered into /var/adm/messages are also sent to another machine and placed into the same directory. What I want to do is place the logs on the remote host somewhere different such as /var/adm/rmtmessages

At the moment, I have duplicated the lines and added a destination of @localhost. Is there a way to specify a certain directory on the localhost to receive the messages?

All help appreciated.

John

 

[huebs]

I don't think you can do it with the plain solaris syslogd, as it only categorizes messages by "facility.level". If you send kern.err to a remote machine, you'll receive it there as kern.err, no matter where it came from. You may want to have a look at syslog-ng, which can do things like /var/log/$HOST/$FACILITY

http://www.balabit.com/products/syslog_ng/

 

[johnwright007]

Thanks for the response. I thought this may be the case but thought I should check it out.

 

[sunbiker]

Best thing is use syslog-ng.
But you will be able to split your messages separated by the hostname in files like messages.hostname if you run the following script in the background.

tail -f /var/adm/messages | while read a
do
x=$a
host=`echo $x |awk ' { print $4 }'`
echo $x >> ${FILE}/messages.${host}
done