Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

with a server assigned two interfaces, .234 and .235, how can I create a filter separating the incoming messages ?

This configuration, only outputs to one folder

---- list interfaces ----

eth0:234 -
eth0:235 -

---- syslog-ng.conf ----

source s_net_234 {
    syslog(ip( port(514) max-connections(300) transport("udp"));

source s_net_235 {
    syslog(ip( port(514) max-connections(300) transport("udp"));

destination d_switches_hosts.235     {
  file("/var/log/HOSTS/switches.235/$HOST_FROM/$YEAR$MONTH$DAY.log" };

destination d_switches_hosts.234     {
  file("/var/log/HOSTS/switches.234/$HOST_FROM/$YEAR$MONTH$DAY.log" };

filter f_switches234   { (source(s_net_234)) };
filter f_switches235   { (source(s_net_235)) };

log { source(s_net_234);

log { source(s_net_235);
share|improve this question
Filter them how? – mdpc Feb 27 '12 at 17:11
I hope you don't mind; I improved the formatting a bit to make it easier to read your config. Please consider taking a moment to catch up on the supported markdown here: Welcome to SF. – Aaron Copley Feb 27 '12 at 17:18
If I am reading your question correctly, the receiving syslog host has the two IP addresses. However, your configuration is written for these two IPs to be the source of the logs, not the destination addresses. Is that correct? – Aaron Copley Feb 27 '12 at 18:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.