syslog-ng Open Source Edition 3.24 - Administration Guide

Steps:

1. Add the hostnames and the respective IP addresses to the file used for local name resolution. On Linux and UNIX systems, this is the /etc/hosts file. Consult the documentation of your operating system for details.

2. Instruct syslog-ng to resolve hostnames locally. Set the use-dns() option of syslog-ng to persist_only.

3. Set the dns-cache-hosts() option to point to the file storing the hostnames.

   options {
       use-dns(persist_only);
       dns-cache-hosts(/etc/hosts);
   };

Steps:

1. Create a /dev directory within the chroot. The applications running in the chroot send their log messages here.

2. Create a local source in the configuration file of the syslog-ng application running outside the chroot. This source should point to the /dev/log file within the chroot (for example, to the /chroot/dev/log directory).

3. Include the source in a log statement.

   NOTE:

   You need to set up timezone information within your chroot as well. This usually means creating a symlink to /etc/localtime.

Use logrotate together with syslog-ng OSE:

• It is ideal for workstations or when processing fewer logs.

• It is included in most distributions by default.

• Less scripting is required, only logrotate has to be configured correctly.

• Requires frequent restart (syslog-ng OSE must be reloaded/restarted when the files are rotated). After rotating the log files, reload syslog-ng OSE using the syslog-ng-ctl reload command, or use another method to send a SIGHUP to syslog-ng OSE.

• The statistics collected by syslog-ng OSE, and the correlation information gathered with Pattern Database, are lost with each restart.

Separate incoming logs based on time, host or other information:

• It is ideal for central log servers, where regular restart of syslog-ng OSE is unfavorable.

• Requires shell scripts or cron jobs to remove old logs.

• It can be done by using macros in the destination name (in the filename, directory name, or the database table name). (For details on using macros, see Templates and macros.)

destination d_sorted {
    file(
        "/var/log/remote/${HOST}/${YEAR}_${MONTH}_${DAY}.log"
        create-dirs(yes)
    );
};

find /var/log/remote/ -daystart -mtime +14 -type f -exec rm {} \;