7.2.2.5. Configuring routers

Logging rules are called Routers in syslog-ng terminology. Rules consist of a source, optionally a filter and a destination. The Routers tab of the System logging component represents this philosophy well.

Configured routers

Figure 7.13. Configured routers

Just like sources, destinations and filters, more than one router can be present in the system. If you use several routers, it is recommended to apply a good naming strategy to easily identify the relevant log rules.

7.2.2.5.1. Procedure – Configure routers

  1. To create a router click on New.

  2. Provide a name for the new router.

  3. Select the components from the list of available sources, filters and destinations.

    Selecting router components

    Figure 7.14. Selecting router components

    Example 7.2. Setting up a router

    If you select base as the source, postfix as the filter (optional, use the small arrow between the text boxes) and syslog as the destination, the resulting router, that is, the log rule looks like this:

    log { source(s_base); filter(f_postfix); destination (d_syslog);flags ( ); };

  4. Specify flags for the router.

    The flags component is empty. Use the checkboxes at the bottom to select the flag. Three possible flags are available.

    • Final flag means that the processing of log statements ends at this point.

      Note

      Ending the processing of log statements does not necessarily mean that matching messages are stored once, as there can be matching log statements processed prior to the current one.

    • Fallback flag marks a log statement for 'fallback'. Defining a fallback statement means that only those messages are sent which do not match any 'non-fallback' log statements.

    • Catchall flag means that the source of the message is ignored, only the filters are taken into account when matching messages.

    Configuring flags for routers

    Figure 7.15. Configuring flags for routers

There are virtually endless possibilities for configuring a complex system logging architecture with syslog-ng. This chapter focused only on the basic concept and provided an architecture view including not only PNS and the MS host nodes, but presenting as well that the syslog-ng architecture can also include practically Unix/Linux machines.

For further information and details, see The syslog-ng Administrator Guide.