I have the logs traditionally kept in /var/log/ piped through syslog-ng. The logs can reach to the terabyte size on a daily basis. In order to make them more manageable. I would like break them out by server and app cluster.
Is this the best way to do it? How do I do this with Syslog-ng that is manageable?