Question

i have a host running syslog-ng. it does all it’s stuff locally fine (creating log files etc). however, i would like to forward ALL of it’s logs to a remote machine – specifically to one facility on the remote machine (local4). i tried playing around with rewrite (set-facility) and templates within the destination (syntax errors) – but to no avail.

destination remote_server { 
  udp(\"172.18.192.8\" port (514)); 
  udp(\"172.18.192.9\" port (514));
}; 
rewrite r_local4 {
  set-facility(local4);
};
filter f_alllogs {
  level (debug...emerg);
};
log {
  source(local);
  filter(f_alllogs);
  rewrite(r_local4)
  destination(remote_server); 
};

Answer 1

AFAIK, currently it is not possible to modify the facility of a message in syslog-ng.

Is there a special reason you want to do it?