+%attr(640,root,logs) %ghost /var/log/cron
+%attr(640,root,logs) %ghost /var/log/daemon
+%attr(640,root,logs) %ghost /var/log/debug
+%attr(640,root,logs) %ghost /var/log/iptables
+%attr(640,root,logs) %ghost /var/log/kernel
+%attr(640,root,logs) %ghost /var/log/lpr
+%attr(640,root,logs) %ghost /var/log/maillog
+%attr(640,root,logs) %ghost /var/log/messages
+%attr(640,root,logs) %ghost /var/log/secure
+%attr(640,root,logs) %ghost /var/log/spooler
+%attr(640,root,logs) %ghost /var/log/syslog
+%attr(640,root,logs) %ghost /var/log/user
+%attr(640,root,logs) %ghost /var/log/xferlog
+
+%if %{with mongodb}
+%files module-afmongodb
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libafmongodb.so
+%endif
+
+%if %{with smtp}
+%files module-afsmtp
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libafsmtp.so
+%endif
+
+%if %{with sql}
+%files module-afsql
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libafsql.so
+%endif
+
+%if %{with http}
+%files module-http
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libhttp.so
+%{_datadir}/syslog-ng/include/scl/telegram
+%endif
+
+%if %{with json}
+%files module-json-plugin
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libjson-plugin.so
+# all below configs require json-plugin
+%{_datadir}/syslog-ng/include/scl/cee
+# R: basicfuncs http json-plugin
+%{_datadir}/syslog-ng/include/scl/discord
+%{_datadir}/syslog-ng/include/scl/cim
+# R: http json-plugin
+%{_datadir}/syslog-ng/include/scl/elasticsearch
+%{_datadir}/syslog-ng/include/scl/ewmm
+%{_datadir}/syslog-ng/include/scl/graylog2
+%{_datadir}/syslog-ng/include/scl/loggly
+%{_datadir}/syslog-ng/include/scl/logmatic
+%{_datadir}/syslog-ng/include/scl/netskope
+# R: basicfuncs http json-plugin
+%{_datadir}/syslog-ng/include/scl/slack
+%endif
+
+%if %{with kafka}
+%files module-kafka
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libkafka.so
+%endif
+
+%if %{with python}
+%files module-python
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libmod-python.so
+%{moduledir}/python
+%endif
+
+%if %{with redis}
+%files module-redis
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libredis.so
+%endif
+
+%if %{with riemann}
+%files module-riemann
+%defattr(644,root,root,755)
+%attr(755,root,root) %{moduledir}/libriemann.so
+%endif
+
+%files libs
+%defattr(644,root,root,755)
+%attr(755,root,root) %{slibdir}/libevtlog-%{mver}.so.*.*.*
+%attr(755,root,root) %{slibdir}/libevtlog-%{mver}.so.0
+%attr(755,root,root) %{slibdir}/libloggen_helper-%{mver}.so.*.*.*
+%attr(755,root,root) %{slibdir}/libloggen_helper-%{mver}.so.0
+%attr(755,root,root) %{slibdir}/libloggen_plugin-%{mver}.so.*.*.*
+%attr(755,root,root) %{slibdir}/libloggen_plugin-%{mver}.so.0
+%attr(755,root,root) %{slibdir}/libsecret-storage.so.*.*.*
+%attr(755,root,root) %{slibdir}/libsecret-storage.so.0
+%attr(755,root,root) %{slibdir}/libsyslog-ng-%{mver}.so.*.*.*
+%attr(755,root,root) %ghost %{slibdir}/libsyslog-ng-%{mver}.so.0
+%dir %{_datadir}/syslog-ng
+
+%files devel
+%defattr(644,root,root,755)
+%attr(755,root,root) %{_libdir}/libevtlog.so
+%attr(755,root,root) %{_libdir}/libloggen_helper.so
+%attr(755,root,root) %{_libdir}/libloggen_plugin.so
+%attr(755,root,root) %{_libdir}/libsecret-storage.so
+%attr(755,root,root) %{_libdir}/libsyslog-ng.so
+%{_libdir}/libsyslog-ng-native-connector.a
+%dir %{_includedir}/syslog-ng
+%{_includedir}/syslog-ng/*.h
+%{_includedir}/syslog-ng/ack-tracker
+%{_includedir}/syslog-ng/compat
+%{_includedir}/syslog-ng/control
+%{_includedir}/syslog-ng/debugger
+%{_includedir}/syslog-ng/filter
+%if %{without system_libivykis}
+%{_includedir}/syslog-ng/ivykis
+%endif
+%{_includedir}/syslog-ng/logmsg
+%{_includedir}/syslog-ng/logproto
+%{_includedir}/syslog-ng/logthrdest
+%{_includedir}/syslog-ng/logthrsource
+%{_includedir}/syslog-ng/modules
+%{_includedir}/syslog-ng/parser
+%{_includedir}/syslog-ng/rewrite
+%{_includedir}/syslog-ng/scanner
+%{_includedir}/syslog-ng/signal-slot-connector
+%{_includedir}/syslog-ng/stats
+%{_includedir}/syslog-ng/str-repr
+%{_includedir}/syslog-ng/template
+%{_includedir}/syslog-ng/timeutils
+%{_includedir}/syslog-ng/transport
+%{_includedir}/syslog-ng/value-pairs
+%{_datadir}/syslog-ng/tools
+%{_pkgconfigdir}/syslog-ng.pc
+%{_pkgconfigdir}/syslog-ng-native-connector.pc
+
+%if %{with tests}
+%files test-devel
+%defattr(644,root,root,755)
+%if "%{_libdir}/syslog-ng" != "{moduledir}"
+%dir %{_libdir}/syslog-ng
+%endif
+%dir %{_libdir}/syslog-ng/libtest
+%{_libdir}/syslog-ng/libtest/libsyslog-ng-test.a
+%{_includedir}/syslog-ng/libtest
+%{_pkgconfigdir}/syslog-ng-test.pc
+%endif