I made my own solution with earlier ideas. Since I manage 4 big PMG servers, syncing and using cat with SSH on the fly is not an option. So I create a script to cache the syslog and merge them for all servers and changed the original: /usr/bin/pmg-log-tracker to place this cache file to the live (/var/log/syslog) location, load: /usr/bin/pmg-log-tracker-default and set the original syslog back (so this will not get corrupt).
Steps (logged in as root):
1. Back-up original: pmg-log-tracker
mv /usr/bin/pmg-log-tracker /usr/bin/pmg-log-tracker-default
2. Create new: /usr/bin/pmg-log-tracker file with this code:
mv /var/log/syslog /var/log/syslog-tmp
mv /tmp/syslog /var/log/syslog
mv /var/log/syslog /tmp/syslog
mv /var/log/syslog-tmp /var/log/syslog
3. Give it execution rights.
chmod +x /usr/bin/pmg-log-tracker
Now create a script to generate: /tmp/syslog
1. Create file: /root/merge-syslog.sh with this code:
cat /var/log/syslog | grep -E 'postfix' > /tmp/syslog
ssh root@mx2 -o ConnectTimeout=2 -o ConnectionAttempts=1 'cat /var/log/syslog | grep -E postfix' >> /tmp/syslog
ssh root@mx3 -o ConnectTimeout=2 -o ConnectionAttempts=1 'cat /var/log/syslog | grep -E postfix' >> /tmp/syslog
ssh root@mx4-o ConnectTimeout=2 -o ConnectionAttempts=1 'cat /var/log/syslog | grep -E postfix' >> /tmp/syslog
cat /tmp/syslog | sort -M > /tmp/syslog-2
uniq /tmp/syslog-2 /tmp/syslog
2. Give it execution rights.
chmod +x /root/merge-syslog.sh
3. Create cronjob, (runtime depends on time to execute /root/merge-syslog.sh)
*/10 * * * * /root/merge-syslog.sh
Warning, your data in the tracker-log can have a delay of 10 minutes with this example. With a small amount of mail, you can run it every 5 minutes or less.
Script is used at one node only, in my case mx1.