On Tue, 24 May, 2005 at 19:21:24 -0400, Ken Schneider wrote: <snip>
<RANT> Another one of those "better" updates to a program (syslog) that used to be fairly easy to configure and now requires six programing classes to understand the conf syntax.
Granted, it's different, takes some getting used to, and maybe not worth it for single hosts.
This is sure to win over a hole slew of windows converts isn't it.
I fail to see what windows converts have to do with this. By the time they get around to being interested in alternative syslogging daemons... well...
What the f**k does this provide that is any better than plain old syslog?
Free text matching/redirection? Lets you specify different destinations for (un)interesting stuff. Saves a lot of grepping.
syslog-ng is supposed to allow you to create/write your own filters (if you know "c" programming that is). But whether or not is does depends on whether or not you can define your own facility/level which I cannot see how.
No. The point is that the whole facility/level concept is very limited. Sure you can have syslog-ng match/filter using facility/level, but it's ability to match/filter on free text is so much more flexible. That's how I get Shorewall messages from remote routers into /remote-log/$host-ip.d/shorewall.log And besides, not all devices that you might want to remote log are equipped with practical facilities/levels.
And if you can't why change something that just plain works?
If you like it, use it. If you don't, don't.
</RANT>
Yeah. I just felt like countering. :) Cheers, Jon -- YMMV