Otdfbt

Find the C-factor of a vote

Inverse-quotes-quine

Suggested order for Amazon Prime Doctor Who series

Why the feminine "la" in "à la Leonardo DiCaprio", though he is a man?

Why do all the teams that I have worked with always finish a sprint without completion of all the stories?

Can White Castle?

Archery in modern conflicts

First-year PhD giving a talk among well-established researchers in the field

If you snatch, I trade

Can any NP-Complete Problem be solved using at most polynomial space (but while using exponential time?)

How are the Zhentarim and Black Fist related?

Did Karl Marx ever use any example that involved cotton and dollars to illustrate the way capital and surplus value were generated?

Are all instances of trolls turning to stone ultimately references back to Tolkien?

What is the origin of Scooby-Doo's name?

Should developer taking test phones home or put in office?

Wifi dongle speed is slower than advertised

Hand soldering SMD 1206 components

How dangerous are set-size assumptions?

How do I turn off a repeating trade?

How do I set an alias to a terminal line?

Can humans ever directly see a few photons at a time? Can a human see a single photon?

Long term BTC investing

Interaction between Leyline of Anticipation and Teferi, Time Raveler

Is it damaging to turn off a small fridge for two days every week?

Facilty used by incoming syslog

syslog message format questionWhich program defaults uses syslog local[0-7] facilities?Filter out a facility in syslog-ngForwarding rsyslog to syslog-ng, with FQDN and facility separationHow can I add values to structured data with rsyslog?Forwarding specific logs rsyslogRewriting facility/severity in rsyslog v7 before shipping off to a remote collectorrsyslog: log message from remote host to specific fileFilter docker messages from syslogWriting MongoDB logs to a remote logging server

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

0

I have been working with rsyslog over the past few weeks and familiarizing myself with it, but I am still a rookie on the subject. One of the use cases I have for it is to receive syslog messages from other systems. This is a common task and, from what I have seen, writing these messages to file usually includes some syntax like the following:

if $HOSTNAME startswith '172.24.42.' then /data/remote_logs/foobar.log
& stop

The question I can't seem to answer is this, do the incoming syslog messages, that a filter statement like the above would catch, use a facility like local0-7? If not, what does it use?

My last question: is there a best practice for separating remote syslog messages from the host system logs without using a filter like the one above for each source?

logging rsyslog centralized-logging

share|improve this question

asked Jun 6 at 16:35

csarkcsark

2644 bronze badges

add a comment | 

0

I have been working with rsyslog over the past few weeks and familiarizing myself with it, but I am still a rookie on the subject. One of the use cases I have for it is to receive syslog messages from other systems. This is a common task and, from what I have seen, writing these messages to file usually includes some syntax like the following:

if $HOSTNAME startswith '172.24.42.' then /data/remote_logs/foobar.log
& stop

The question I can't seem to answer is this, do the incoming syslog messages, that a filter statement like the above would catch, use a facility like local0-7? If not, what does it use?

My last question: is there a best practice for separating remote syslog messages from the host system logs without using a filter like the one above for each source?

logging rsyslog centralized-logging

share|improve this question

asked Jun 6 at 16:35

csarkcsark

2644 bronze badges

add a comment | 

I have been working with rsyslog over the past few weeks and familiarizing myself with it, but I am still a rookie on the subject. One of the use cases I have for it is to receive syslog messages from other systems. This is a common task and, from what I have seen, writing these messages to file usually includes some syntax like the following:

if $HOSTNAME startswith '172.24.42.' then /data/remote_logs/foobar.log
& stop

The question I can't seem to answer is this, do the incoming syslog messages, that a filter statement like the above would catch, use a facility like local0-7? If not, what does it use?

My last question: is there a best practice for separating remote syslog messages from the host system logs without using a filter like the one above for each source?

logging rsyslog centralized-logging

share|improve this question

asked Jun 6 at 16:35

csarkcsark

2644 bronze badges

if $HOSTNAME startswith '172.24.42.' then /data/remote_logs/foobar.log
& stop

share|improve this question

asked Jun 6 at 16:35

csarkcsark

2644 bronze badges

share|improve this question

asked Jun 6 at 16:35

csarkcsark

2644 bronze badges

asked Jun 6 at 16:35

csarkcsark

2644 bronze badges

asked Jun 6 at 16:35

csarkcsark

2644 bronze badges