Let's take this one thing at a time...
Can I create a second source that defines the PGP server, or will that conflict with the current source that's a catch all? How do I exclude a host from the catch-all source and free it up to be defined? In addition, how do I deal with the program specific filters?
Yes, this is pretty easy. I am assuming that the syslog-ng server is not the same server as the PGP server. On your syslog-ng server, you'll need a config that basically looks like this:
source s_net { ip(); };
filter f_pgp { netmask(192.168.0.5); };
filter f_not_php { not netmask(192.168.0.5); };
destination d_pgp{ file("/var/log/pgp"); };
destination d_messages { file("/var/log/messages"); };
log {source(s_net); filter(f_pgp); destination(d_pgp); };
log {source(s_net); filter(f_not_pgp); destination(d_messages); };
In addition, how do I deal with the program specific filters? Does syslog-ng just pass on the filter name and I can catch it that way? It's not using any of the local0-7 facilities, it's creating it's own custom source listening to a specific port across /dev/log and applying it's own program specific filters.
No, it doesn't pass on the filters. But, I *think* that the program filters may work on the syslog-ng server. The program filter is simply looking at a specific part of a syslog message for some text, and runs a compare on that text.
So, if you are wanting to separate those logs out by program type, the way it is done on the PGP server, you can try copying the filters over to the syslog-ng server. If they don't work, we'll have to take a look at the content of some of the logs to see if we can build alternate filters using the match() command.
