| Andrew Geissler | f103a7f | 2021-05-07 16:09:40 -0500 | [diff] [blame^] | 1 | @version: 3.31 | 
| Brad Bishop | 1a4b7ee | 2018-12-16 17:11:34 -0800 | [diff] [blame] | 2 | # | 
|  | 3 | # Syslog-ng configuration file, compatible with default Debian syslogd | 
|  | 4 | # installation. Originally written by anonymous (I can't find his name) | 
|  | 5 | # Revised, and rewrited by me (SZALAY Attila <sasa@debian.org>) | 
| Brad Bishop | 868407c | 2019-11-04 13:24:47 -0500 | [diff] [blame] | 6 | # | 
|  | 7 | # Move to 3.19 | 
|  | 8 | #     Only change is to add dns_cache(no) to options to suppress initialization warning. | 
|  | 9 | # | 
|  | 10 | #     Joe Slater <joe.slater@windriver.com> | 
| Brad Bishop | 1a4b7ee | 2018-12-16 17:11:34 -0800 | [diff] [blame] | 11 |  | 
|  | 12 | # First, set some global options. | 
| Brad Bishop | 868407c | 2019-11-04 13:24:47 -0500 | [diff] [blame] | 13 | options { chain_hostnames(off); flush_lines(0); use_dns(no); dns_cache(no); use_fqdn(no); | 
| Brad Bishop | 1a4b7ee | 2018-12-16 17:11:34 -0800 | [diff] [blame] | 14 | owner("root"); group("adm"); perm(0640); stats_freq(0); | 
|  | 15 | bad_hostname("^gconfd$"); | 
|  | 16 | }; | 
|  | 17 |  | 
|  | 18 | ######################## | 
|  | 19 | # Sources | 
|  | 20 | ######################## | 
|  | 21 | # This is the default behavior of sysklogd package | 
|  | 22 | # Logs may come from unix stream, but not from another machine. | 
|  | 23 | # | 
|  | 24 | source s_src { unix-dgram("/dev/log"); internal(); | 
|  | 25 | file("/proc/kmsg" program_override("kernel")); | 
|  | 26 | }; | 
|  | 27 |  | 
|  | 28 | # If you wish to get logs from remote machine you should uncomment | 
|  | 29 | # this and comment the above source line. | 
|  | 30 | # | 
|  | 31 | #source s_net { tcp(ip(127.0.0.1) port(1000) authentication(required) encrypt(allow)); }; | 
|  | 32 |  | 
|  | 33 | ######################## | 
|  | 34 | # Destinations | 
|  | 35 | ######################## | 
|  | 36 | # First some standard logfile | 
|  | 37 | # | 
|  | 38 | destination d_auth { file("/var/log/auth.log"); }; | 
|  | 39 | destination d_cron { file("/var/log/cron.log"); }; | 
|  | 40 | destination d_daemon { file("/var/log/daemon.log"); }; | 
|  | 41 | destination d_kern { file("/var/log/kern.log"); }; | 
|  | 42 | destination d_lpr { file("/var/log/lpr.log"); }; | 
|  | 43 | destination d_mail { file("/var/log/mail.log"); }; | 
|  | 44 | destination d_syslog { file("/var/log/syslog"); }; | 
|  | 45 | destination d_user { file("/var/log/user.log"); }; | 
|  | 46 | destination d_uucp { file("/var/log/uucp.log"); }; | 
|  | 47 |  | 
|  | 48 | # This files are the log come from the mail subsystem. | 
|  | 49 | # | 
|  | 50 | destination d_mailinfo { file("/var/log/mail/mail.info"); }; | 
|  | 51 | destination d_mailwarn { file("/var/log/mail/mail.warn"); }; | 
|  | 52 | destination d_mailerr { file("/var/log/mail/mail.err"); }; | 
|  | 53 |  | 
|  | 54 | # Logging for INN news system | 
|  | 55 | # | 
|  | 56 | destination d_newscrit { file("/var/log/news/news.crit"); }; | 
|  | 57 | destination d_newserr { file("/var/log/news/news.err"); }; | 
|  | 58 | destination d_newsnotice { file("/var/log/news/news.notice"); }; | 
|  | 59 |  | 
|  | 60 | # Some 'catch-all' logfiles. | 
|  | 61 | # | 
|  | 62 | destination d_debug { file("/var/log/debug"); }; | 
|  | 63 | destination d_error { file("/var/log/error"); }; | 
|  | 64 | destination d_messages { file("/var/log/messages"); }; | 
|  | 65 |  | 
|  | 66 | # The root's console. | 
|  | 67 | # | 
|  | 68 | destination d_console { usertty("root"); }; | 
|  | 69 |  | 
|  | 70 | # Virtual console. | 
|  | 71 | # | 
|  | 72 | destination d_console_all { file("/dev/tty10"); }; | 
|  | 73 |  | 
|  | 74 | # The named pipe /dev/xconsole is for the nsole' utility.  To use it, | 
|  | 75 | # you must invoke nsole' with the -file' option: | 
|  | 76 | # | 
|  | 77 | #    $ xconsole -file /dev/xconsole [...] | 
|  | 78 | # | 
|  | 79 | destination d_xconsole { pipe("/dev/xconsole"); }; | 
|  | 80 |  | 
|  | 81 | # Send the messages to an other host | 
|  | 82 | # | 
|  | 83 | #destination d_net { tcp("127.0.0.1" port(1000) authentication(on) encrypt(on) log_fifo_size(1000)); }; | 
|  | 84 |  | 
|  | 85 | # Debian only | 
|  | 86 | destination d_ppp { file("/var/log/ppp.log"); }; | 
|  | 87 |  | 
|  | 88 | ######################## | 
|  | 89 | # Filters | 
|  | 90 | ######################## | 
|  | 91 | # Here's come the filter options. With this rules, we can set which | 
|  | 92 | # message go where. | 
|  | 93 |  | 
|  | 94 | filter f_dbg { level(debug); }; | 
|  | 95 | filter f_info { level(info); }; | 
|  | 96 | filter f_notice { level(notice); }; | 
|  | 97 | filter f_warn { level(warn); }; | 
|  | 98 | filter f_err { level(err); }; | 
|  | 99 | filter f_crit { level(crit .. emerg); }; | 
|  | 100 |  | 
|  | 101 | filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; | 
|  | 102 | filter f_error { level(err .. emerg) ; }; | 
|  | 103 | filter f_messages { level(info,notice,warn) and | 
|  | 104 | not facility(auth,authpriv,cron,daemon,mail,news); }; | 
|  | 105 |  | 
|  | 106 | filter f_auth { facility(auth, authpriv) and not filter(f_debug); }; | 
|  | 107 | filter f_cron { facility(cron) and not filter(f_debug); }; | 
|  | 108 | filter f_daemon { facility(daemon) and not filter(f_debug); }; | 
|  | 109 | filter f_kern { facility(kern) and not filter(f_debug); }; | 
|  | 110 | filter f_lpr { facility(lpr) and not filter(f_debug); }; | 
|  | 111 | filter f_local { facility(local0, local1, local3, local4, local5, | 
|  | 112 | local6, local7) and not filter(f_debug); }; | 
|  | 113 | filter f_mail { facility(mail) and not filter(f_debug); }; | 
|  | 114 | filter f_news { facility(news) and not filter(f_debug); }; | 
|  | 115 | filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); }; | 
|  | 116 | filter f_user { facility(user) and not filter(f_debug); }; | 
|  | 117 | filter f_uucp { facility(uucp) and not filter(f_debug); }; | 
|  | 118 |  | 
|  | 119 | filter f_cnews { level(notice, err, crit) and facility(news); }; | 
|  | 120 | filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; | 
|  | 121 |  | 
|  | 122 | filter f_ppp { facility(local2) and not filter(f_debug); }; | 
|  | 123 | filter f_console { level(warn .. emerg); }; | 
|  | 124 |  | 
|  | 125 | ######################## | 
|  | 126 | # Log paths | 
|  | 127 | ######################## | 
|  | 128 | log { source(s_src); filter(f_auth); destination(d_auth); }; | 
|  | 129 | log { source(s_src); filter(f_cron); destination(d_cron); }; | 
|  | 130 | log { source(s_src); filter(f_daemon); destination(d_daemon); }; | 
|  | 131 | log { source(s_src); filter(f_kern); destination(d_kern); }; | 
|  | 132 | log { source(s_src); filter(f_lpr); destination(d_lpr); }; | 
|  | 133 | log { source(s_src); filter(f_syslog3); destination(d_syslog); }; | 
|  | 134 | log { source(s_src); filter(f_user); destination(d_user); }; | 
|  | 135 | log { source(s_src); filter(f_uucp); destination(d_uucp); }; | 
|  | 136 |  | 
|  | 137 | log { source(s_src); filter(f_mail); destination(d_mail); }; | 
|  | 138 | #log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); }; | 
|  | 139 | #log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); }; | 
|  | 140 | #log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); }; | 
|  | 141 |  | 
|  | 142 | log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); }; | 
|  | 143 | log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); }; | 
|  | 144 | log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); }; | 
|  | 145 | #log { source(s_src); filter(f_cnews); destination(d_console_all); }; | 
|  | 146 | #log { source(s_src); filter(f_cother); destination(d_console_all); }; | 
|  | 147 |  | 
|  | 148 | #log { source(s_src); filter(f_ppp); destination(d_ppp); }; | 
|  | 149 |  | 
|  | 150 | log { source(s_src); filter(f_debug); destination(d_debug); }; | 
|  | 151 | log { source(s_src); filter(f_error); destination(d_error); }; | 
|  | 152 | log { source(s_src); filter(f_messages); destination(d_messages); }; | 
|  | 153 |  | 
|  | 154 | log { source(s_src); filter(f_console); destination(d_console_all); | 
|  | 155 | destination(d_xconsole); }; | 
|  | 156 | log { source(s_src); filter(f_crit); destination(d_console); }; | 
|  | 157 |  | 
|  | 158 | # All messages send to a remote site | 
|  | 159 | # | 
|  | 160 | #log { source(s_src); destination(d_net); }; |