On 2015/06/28 12:31, Alexander Bluhm wrote: > Hi, > > I want to store all syslog messages received from a specific host > into a single log file. For programs this is already implemented > for !prog blocks. So do the same with +host for hostnames. > > This implementation is based on a diff that Gregory Edigarov sent > to me. So there is at least one other user who needs this. > > I have an alternative diff, that changes the facility in the sending > syslogd. When you specify @remotehost:514/local7 in the sending > syslog.conf, then you can use the facilty on the receiving side to > split the messages. > > What is the best solution? > - Match on the hostname at the receiving side. > - Change the facility at the sending side. > - Commit both and let the user configure what fits in his environmet.
OK with me for the receiving-side match. I'll definitely use this, the typical case for me is receiving messages from some non-OpenBSD device (switches, voip phones, etc) using some strange facility that cannot be adjusted; I think this is a relatively common situation. This removes another big reason for using a syslogd other than the one in base. Personally I don't see myself using the sender-side option (it seems like it might be a nice feature in some cases, but I don't think I have a use for it myself).
