Separate log files per virtual/pool/node

There are some syslog-ng examples as well as links to the syslog-ng manual in this Codeshare example:

http://devcentral.f5.com/wiki/default.aspx/iRules/LogHttpTcpUdpToSyslogng.html

Based on this document (Click here starting with A single log message can be sent to different log files several times.), something like this should work (though I didn't test it):

 
  
  local0. Filters 
  
  local0.*                                      /var/log/ltm 
 filter f_local0 { 
    facility(local0) and level(info..emerg); 
 }; 
  
  Filter for local0 VIP1 messages 
 filter f_local0_vip1 { 
    facility(local0) and level(info..emerg) and match("vip1"); 
 }; 
  Filter for local0 VIP2 messages 
 filter f_local0_vip2 { 
    facility(local0) and level(info..emerg) and match("vip2"); 
 }; 
  Filter for local0 VIP3 messages 
 filter f_local0_vip3 { 
    facility(local0) and level(info..emerg) and match("vip3"); 
 }; 
  
  
  local0. Destinations 
  
  Default LTM log file 
 destination d_ltm { 
    file("/var/log/ltm" create_dirs(yes)); 
 }; 
  LTM log file for VIP1 
 destination d_vip1 { 
    file("/var/log/ltm_vip1" create_dirs(yes)); 
 }; 
  LTM log file for VIP2 
 destination d_vip2 { 
    file("/var/log/ltm_vip2" create_dirs(yes)); 
 }; 
  LTM log file for VIP3 
 destination d_vip3 { 
    file("/var/log/ltm_vip3" create_dirs(yes)); 
 }; 
  
  
  local0. Log statements 
  
  Default LTM log statement 
 log { 
    source(local); 
    filter(f_local0); 
    destination(d_ltm); 
 }; 
  VIP1 log statement 
 log { 
    source(local); 
    filter(f_local0_vip1); 
    destination(d_vip1); 
 }; 
  VIP2 log statement 
 log { 
    source(local); 
    filter(f_local0_vip2); 
    destination(d_vip2); 
 }; 
  VIP3 log statement 
 log { 
    source(local); 
    filter(f_local0_vip3); 
    destination(d_vip3); 
 }; 
 

This assumes that the strings, vip1, vip2 and vip3 are included in each log statement for the related VIPs. You'd need to tailor the filter statements match ("vip") to your environment.

Aaron