Destination drivers

Destination drivers output log messages to somewhere outside syslog-ng: a file or a network socket.

file()

The file driver is one of the most important destination drivers in syslog-ng. It allows you to output logmessages to the named file, or as you'll see to a set of files.

The destination filename may include macros which gets expanded when the logmessage is written, thus a simple file() driver may result in several files to be created. Macros can be included by prefixing the macro name with a '$' sign (without the quotes), just like in Perl/PHP.

Table 3-3. Available macros in filename expansion

NameDescription
HOST The name of the source host where the message is originated from. If the message traverses several hosts, and chain_hostnames() is on, the first one is used.
FACILITY The name of the facility, the message is tagged as coming from.
PRIORITY or LEVEL The priority of the message.
PROGRAM The name of the program the message was sent by.
YEAR The year the message was sent.
MONTH The month the message was sent.
DAY The day of month the message was sent.