syslog-ng Open Source Edition 3.22 - Administration Guide

Steps:

1. Create a /dev directory within the chroot. The applications running in the chroot send their log messages here.

2. Create a local source in the configuration file of the syslog-ng application running outside the chroot. This source should point to the /dev/log file within the chroot (for example to the /chroot/dev/log directory).

3. Include the source in a log statement.

   NOTE: You need to set up timezone information within your chroot as well. This usually means creating a symlink to /etc/localtime.

Use logrotate together with syslog-ng OSE:

• Ideal for workstations or when processing fewer logs.

• It is included in most distributions by default.

• Less scripting is required, only logrotate has to be configured correctly.

• Requires frequent restart (syslog-ng OSE must be reloaded/restarted when the files are rotated). After rotating the log files, reload syslog-ng OSE using the syslog-ng-ctl reload command, or use another method to send a SIGHUP to syslog-ng OSE.

• The statistics collected by syslog-ng OSE, and the correlation information gathered with Pattern Database is lost with each restart.

Separate incoming logs based on time, host or other information:

• Ideal for central log servers, where regular restart of syslog-ng OSE is unfavorable.

• Requires shell scripts or cron jobs to remove old logs.

• It can be done by using macros in the destination name (in the filename, directory name, or the database table name). (For details on using macros, see Templates and macros.)

destination d_sorted {
    file(
        "/var/log/remote/${HOST}/${YEAR}_${MONTH}_${DAY}.log"
        create-dirs(yes)
    );
};

destination d_logstore {
    logstore(
        "/var/log/remote/${HOST}/${YEAR}_${MONTH}_${DAY}.lgs"
        compress(9)
        create-dirs(yes)
    );
};

find /var/log/remote/ -daystart -mtime +14 -type f -exec rm {} \;