syslog server. syslog-ng.conf

source from_local {   unix-stream ("/dev/log");
                      file ("/proc/kmsg");
                      internal();
                  };

# Copy of remote logs
source from_server1 { tcp (ip(10.0.0.2) port(514) max-connections(2)); };
source from_server2 { tcp (ip(10.0.0.3) port(514) max-connections(2)); };
...
filter apache            { match("apache") or program("httpd") or program("apache"); };
...
destination server1-apache         { file("/var/log/server1/apache.log"); };
destination server2-apache         { file("/var/log/server2/apache.log"); };
...
log { source(from_server1); filter(apache);              destination(server1-apache); };
log { source(from_server2); filter(apache);              destination(server2-apache); };

source s_internal { internal(); }; destination d_syslognglog { file("/var/log/syslog-ng.log"); }; log { source(s_internal); destination(d_syslognglog); };

source s_local { unix-dgram("/dev/log"); }; filter f_messages { level(info..emerg); }; filter f_secure { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_emerg { level(emerg); }; filter f_spooler { level(crit..emerg) and facility(uucp, news); }; filter f_local7 { facility(local7); }; destination d_messages { file("/var/log/messages"); }; destination d_secure { file("/var/log/secure"); }; destination d_maillog { file("/var/log/maillog"); }; destination d_cron { file("/var/log/cron"); }; destination d_console { usertty("root"); }; destination d_spooler { file("/var/log/spooler"); }; destination d_bootlog { file("/var/log/boot.log"); }; log { source(s_local); filter(f_emerg); destination(d_console); }; log { source(s_local); filter(f_secure); destination(d_secure); flags(final); };log { source(s_local); filter(f_mail); destination(d_maillog); flags(final); }; log { source(s_local); filter(f_cron); destination(d_cron); flags(final); }; log { source(s_local); filter(f_spooler); destination(d_spooler); }; log { source(s_local); filter(f_local7); destination(d_bootlog); }; log { source(s_local); filter(f_messages); destination(d_messages); }; source s_remote { tcp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(9000)); udp(ip(0.0.0.0) port(514)); }; destination d_separatedbyhosts { file("/logs-servers/$HOST/$YEAR/$MONTH/$DAY/messages" owner("root") group("root") perm(0644) dir_perm(0755) create_dirs(yes)); }; log { source(s_remote); destination(d_separatedbyhosts); }; При такой схемке локальные логи будут храниться как обычно а логи с серваков в каталоге /log-servers/