Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set up a heroku log drain, which sends messages to port 514 on my logging instance. The log server sends the messages /var/log/syslog, though, and I'd like it to send them to /var/log/appname.log or something so that they're isolated.

How do I do this? I read something about splitting based on hostname, but I'm not sure how to determine which hostname heroku would be sending over.

share|improve this question
I recommend looking in /etc/rsyslog.d/* for example configurations. – Jay Taylor Jul 30 '12 at 22:30
up vote 1 down vote accepted

Heroku ties a "Drain id" to each log drain that you set up and sends that as the hostname. It'll stay constant until you remove the drain.

You can get the drain id with:

heroku drains
> syslog://your-url (drain-id)

Then it's just a matter of configuring /etc/rsyslog.conf. This hostname filter works for me

if $hostname isequal 'drain-id' then /var/log/app-name.log
& ~
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.