syslog-ng.conf

   1 @version: 3.5
   2 #
   3 # Syslog-ng configuration for PLD Linux
   4 #
   5 # See syslog-ng(8) and syslog-ng.conf(5) for more information.
   6 #
   7
   8 options {
   9         flush_lines(0);
  10         owner(root);
  11         group(logs);
  12         perm(0640);
  13         create_dirs(yes);
  14         dir_owner(root);
  15         dir_group(logs);
  16         dir_perm(0750);
  17         stats_freq(3600);
  18         time_reopen(10);
  19         time_reap(360);
  20         mark_freq(600);
  21         threaded(yes);
  22 };
  23
  24 source s_sys    {
  25         file ("/proc/kmsg" program_override("kernel"));
  26         unix-stream("/dev/log" max-connections(1000) log_iw_size(100000));
  27 # if using systemd, comment out the line above, and uncomment line below
  28 #       unix-dgram("/run/systemd/journal/syslog");
  29 # and add ForwardToSyslog=yes to /etc/systemd/journald.conf
  30         internal();
  31 };
  32
  33 # uncomment the line below if you want to setup syslog server
  34 #source s_net   { udp(); };
  35
  36 # if using systemd, an IP address instead of name may be required here
  37 #destination d_loghost  { udp("loghost" port(514)); };
  38
  39 destination d_kern      { file("/var/log/kernel"); };
  40 destination d_messages  { file("/var/log/messages"); };
  41 destination d_authlog   { file("/var/log/secure"); };
  42 destination d_mail      { file("/var/log/maillog"); };
  43 destination d_uucp      { file("/var/log/spooler"); };
  44 destination d_debug     { file("/var/log/debug"); };
  45 destination d_cron      { file("/var/log/cron" owner(root) group(crontab) perm(0660)); };
  46 destination d_syslog    { file("/var/log/syslog"); };
  47 destination d_daemon    { file("/var/log/daemon"); };
  48 destination d_lpr               { file("/var/log/lpr"); };
  49 destination d_user      { file("/var/log/user"); };
  50 destination d_ppp               { file("/var/log/ppp"); };
  51 destination d_ftp               { file("/var/log/xferlog"); };
  52 destination d_audit     { file("/var/log/audit"); };
  53 destination d_postgres  { file("/var/log/pgsql"); };
  54 destination d_freshclam { file("/var/log/freshclam.log"); };
  55
  56 # Log iptables messages to separate file
  57 destination d_iptables  { file("/var/log/iptables"); };
  58
  59 destination d_console   { usertty("root"); };
  60 #destination d_console_all      { file("/dev/tty12"); };
  61
  62 destination d_xconsole  { pipe("/dev/xconsole"); };
  63
  64 destination d_newscrit  { file("/var/log/news/news.crit" owner(news) group(news)); };
  65 destination d_newserr   { file("/var/log/news/news.err" owner(news) group(news)); };
  66 destination d_newsnotice        { file("/var/log/news/news.notice" owner(news) group(news)); };
  67
  68 # Filters for standard syslog(3) facilities
  69 #filter f_audit         { facility(audit); };
  70 filter f_authpriv       { facility(authpriv, auth); };
  71 filter f_cron           { facility(cron); };
  72 filter f_daemon         { facility(daemon); };
  73 filter f_ftp            { facility(ftp); };
  74 filter f_kern           { facility(kern); };
  75 filter f_lpr            { facility(lpr); };
  76 filter f_mail           { facility(mail); };
  77 filter f_news           { facility(news); };
  78 filter f_syslog         { facility(syslog); };
  79 filter f_user           { facility(user); };
  80 filter f_uucp           { facility(uucp); };
  81 filter f_local0         { facility(local0); };
  82 filter f_local1         { facility(local1); };
  83 filter f_local2         { facility(local2); };
  84 filter f_local3         { facility(local3); };
  85 filter f_local4         { facility(local4); };
  86 filter f_local5         { facility(local5); };
  87 filter f_local6         { facility(local6); };
  88 filter f_local7         { facility(local7); };
  89
  90 # Filters for standard syslog(3) priorities
  91 filter p_debug          { level(debug); };
  92 filter p_info           { level(info); };
  93 filter p_notice         { level(notice); };
  94 filter p_warn           { level(warn); };
  95 filter p_err            { level(err); };
  96 filter p_alert          { level(alert); };
  97 filter p_crit           { level(crit); };
  98 filter p_emergency      { level(emerg); };
  99
 100 # Additional filters for specific programs/use
 101 filter f_freshclam      { program(freshclam); };
 102 filter f_ppp            { program(pppd) or program(chat); };
 103 filter f_postgres       { program(postgres); };
 104 filter f_iptables       { match("IN=[A-Za-z0-9\.]* OUT=[A-Za-z0-9\.]*" value("MESSAGE")); };
 105
 106 log { source(s_sys); filter(f_authpriv);        destination(d_authlog); };
 107 log { source(s_sys); filter(f_cron);            destination(d_cron); };
 108 log { source(s_sys); filter(f_daemon);          destination(d_daemon); };
 109 log { source(s_sys); filter(f_ftp);             destination(d_ftp); };
 110 log { source(s_sys); filter(f_kern);            destination(d_kern); };
 111 log { source(s_sys); filter(f_lpr);             destination(d_lpr); };
 112 log { source(s_sys); filter(f_mail);                    destination(d_mail); };
 113 log { source(s_sys); filter(f_news); filter(p_crit);    destination(d_uucp); };
 114 log { source(s_sys); filter(f_news); filter(p_crit);    destination(d_newscrit); };
 115 log { source(s_sys); filter(f_news); filter(p_err);     destination(d_newserr); };
 116 log { source(s_sys); filter(f_news); filter(p_warn);    destination(d_newsnotice); };
 117 log { source(s_sys); filter(f_news); filter(p_notice);  destination(d_newsnotice); };
 118 log { source(s_sys); filter(f_news); filter(p_info);    destination(d_newsnotice); };
 119 log { source(s_sys); filter(f_news); filter(p_debug);   destination(d_newsnotice); };
 120 log { source(s_sys); filter(f_syslog);          destination(d_syslog); };
 121 log { source(s_sys); filter(f_user);            destination(d_user); };
 122 log { source(s_sys); filter(f_uucp);            destination(d_uucp); };
 123
 124 log { source(s_sys); filter(p_debug);           destination(d_debug); };
 125
 126 log { source(s_sys); filter(f_daemon); filter(f_ppp);           destination(d_ppp); };
 127 log { source(s_sys); filter(f_local6); filter(f_freshclam);     destination(d_freshclam); };
 128 log { source(s_sys); filter(f_local0); filter(f_postgres);      destination(d_postgres); };
 129 #log { source(s_sys); filter(f_iptables);       destination(d_iptables); };
 130
 131 log { source(s_sys); filter(p_emergency);       destination(d_console); };
 132 #log { source(s_sys); destination(d_console_all); };
 133
 134 #  This is a catchall statement, and should catch all messages which were not
 135 #  accepted any of the previous statements.
 136 log { source(s_sys); destination(d_messages); flags(fallback); };
 137
 138 # Network syslogging
 139 #log { source(s_sys); destination(d_loghost); };