syslog-ng

[Chris Smith]

On Friday 19 October 2007, Chris Smith wrote:
> On Friday 19 October 2007, Anders Norrbring wrote:
> > Hi, I need help setting up Cyrus and syslog-ng to have all the Cyrus
> > logs in their own files.
> >
> > It seems like I just cannot get it right, no matter how I try.
> > So, I'd be grateful for setup info on syslog-ng to accomplish this.
>
> My distro sets up cyrus to use the local6 facility for logging. I use the
> following lines in my syslog-ng.conf (in their proper sections):
> ===================================
> destination d_local6 { file("/var/log/mail/imapd.log"); };
> filter f_local6 { facility(local6); };
> log { source(src); filter(f_local6); destination(d_local6); flags(final);
> }; ===================================
>
> Works just fine. I put all of my mail logs in a separate directory
> (/var/log/mail/).
> Note - you may have to "touch" the destination file to create it.

Just adding that, as Baltasar stated, some programs may use the same facility 
and if this is the case you can probably filter on program name (or match, or 
program name and match, etc.). Some that I filter this way are:
=====================================
filter f_cupsd { program(cupsd); };
filter f_dhcpd { program(dhcpd); };
filter f_slapd { program(slapd); };
filter f_rsync { program(rsync); };
=====================================
Normally if the facility is unique I use it for the filter.

-- 
Chris