Can stock syslog do hostA -> fileA?

[Janos Dohanics]

On Thursday 26 February 2009 09:19:34 am Paul Halliday wrote:
> I am collecting syslogs from a PIX and a couple of Barracudas. It
> would be a lot easier for each to have their own logfile. I have been
> poking around a bit; I saw this one:
>
> +host1 /var/log/host1
>
> but it doesn't appear to work. Is it being trumped by something else
> in the config file? Is the syntax wrong?
>
> Thanks.
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to
> "freebsd-questions-unsubscribe at freebsd.org"

Here is what works for me, logging a router running pFsense::

In /etc/rc.conf:

syslogd_enable="YES"
syslogd_flags="-a 192.168.0.1 -v"

In /etc/syslogd.conf:

+pfsense
*.*                                             /var/log/pfsense.log
+*

In /etc/hosts:

192.168.0.1     pfsense

Then, do a /etc/rc.d/syslogd restart

I should note that in /etc/syslogd.conf the +pfsense entry block is after the 
cron.* entry and before the *.=debug. I seem to remember that when I appended 
the +pfsense block to the end of /etc/syslogd.conf, everything was logged 
to /var/log/messages - may be I made a typo then (?); I didn't think that the 
order of entries matters...

Hope this helps,

-- 
Janos Dohanics