Logging to a different local facility?
This is going to be difficult for me to explain but Ill do my best..
I have a scenario where I want to take all my logs and log it to a different facility on the remote syslog. Im trying to send all my traffic to a syslog device but instead of having all of the traffic mixed up (from multiple sources) and filter it on the syslog... i have been asked to make all my LTM logs to local5. In this case, the syslog device has a script to put the local5 traffic in a specific folder for LTM. For example, local1 is routers, local2 is switches... local5 is LTM.
How do I make this change? Is it syslog-ng? Im looking for anything to key off of so I can googlefu it but Im missing the appropriate syntax or something because Im just not finding it.
Overall goal:
-
Change all logs to local5.
-
Limit what gets logged to local5.
2a. major errors get logged to local5.
2b. all changes get logged to local5.
TIA