@version:3.0

###
#
# Name		:	syslog-ng.conf
# Author	:	Vladimir Vydra <vydra@fria.fri.utc.sk>
# LastChangement:	2003-02-14
#
##


##
# *** Configuration - global
# http://www.balabit.hu/static/syslog-ng/reference/x601.html
##

options { 
    chain_hostnames(no); 	# usage of long names
    flush_lines(0);		# how many events nefore writing to log
#    sync(0); 			# how mutch of events nefore writing to log
    time_reopen(2);		# if write faile wait 2sec, before traing again (net)
#    log_fifo_size(1000);	# size of the output buffer (rows)
    use_dns(no);		# don't resolve
    use_fqdn(no);		# use fqdn and not hostname
    owner("root");		# owner of the logs
    group("root");
    perm(0640);			# default permission on log files.
    dir_perm(0700);
    create_dirs(no);		# will be the dirs created automaticali ? (I prefer no)
};


##
# *** Sources
# http://www.balabit.hu/static/syslog-ng/reference/reference.html#AEN180 
##

source src { 
    unix-stream("/dev/log" 	# sockets, max 20 conn. at once
#	max-connections(20) 
    ); 	
    internal(); 		# messages from syslog itselfs

};

source s_kern { 
    file("/proc/kmsg"); 	# kernel msg
};


## Receiving data from net
# it's easy to collect data from net ...

#source s_tcp { 
#    tcp(ip(127.0.0.1) port(1999) max-connections(10)); 
#};

#source s_udp {
#    udp(); 
#};



##
# *** Destinations
# http://www.balabit.hu/static/syslog-ng/reference/x354.html 
##

## Log ALL
destination d_full {
    file("/var/log/full/full_$YEAR-$MONTH-$DAY.log"
	create_dirs(yes)
    );
};

destination d_fullhosts {
    file("/var/log/full/$HOST/$HOST-$ISODATE.log"
	create_dirs(yes)
    );
};

destination d_kern	{ file("/var/log/kmsg-kern.log" 
			    perm(0600)
			  ); 
};
destination d_named	{ file("/var/log/full/service/named-$YEAR$MONTH$DAY.log"
			    create_dirs(yes)
			  );
};
destination d_proftpd	{ file("/var/log/full/service/proftpd-$YEAR$MONTH$DAY.log"
			    create_dirs(yes)
			  );
};
destination d_sshd	{ file("/var/log/full/service/sshd-$YEAR$MONTH$DAY.log"
			    create_dirs(yes)
			  );
};
destination d_imap	{ file("/var/log/full/service/imap-$YEAR$MONTH$DAY.log"
			    create_dirs(yes)
			  );
};
destination d_pop3	{ file("/var/log/full/service/pop3-$YEAR$MONTH$DAY.log"
			    create_dirs(yes)
			  );
};

destination d_postfix	{ file("/var/log/full/service/postfix-$YEAR$MONTH$DAY.log"
			    create_dirs(yes)
			  );
};

destination d_syslogng	{ file("/var/log/full/service/syslogng-$YEAR$MONTH$DAY.log"
			    create_dirs(yes)
			  );
};

## Default destinations

destination authlog	{ file("/var/log/auth.log" create_dirs(yes) ); };
#destination syslog	{ file("/var/log/syslog" create_dirs(yes) ); };
destination cron	{ file("/var/log/cron.log" create_dirs(yes) );};
destination daemon	{ file("/var/log/daemon.log" create_dirs(yes) );};
destination kern	{ file("/var/log/kern.log" create_dirs(yes) );};
destination lpr		{ file("/var/log/lpr.log" create_dirs(yes) );};
destination user	{ file("/var/log/user.log" create_dirs(yes) );};
destination uucp	{ file("/var/log/uucp.log" create_dirs(yes) );};
# In general - peoples don't have ppp facility in kernel - if yes - uncoment this
#destination ppp 	{ file("/var/log/ppp.log" create_dirs(yes) );};
destination mail	{ file("/var/log/mail.log" create_dirs(yes) );};

destination mailinfo	{ file("/var/log/mail.info" create_dirs(yes) );};
destination mailwarn	{ file("/var/log/mail.warn" create_dirs(yes) );};
destination mailerr	{ file("/var/log/mail.err" create_dirs(yes) );};

destination newscrit	{ file("/var/log/news/news.crit" create_dirs(yes) );};
destination newserr	{ file("/var/log/news/news.err" create_dirs(yes) );};
destination newsnotice	{ file("/var/log/news/news.notice" create_dirs(yes) );};

destination debug 	{ file("/var/log/debug" create_dirs(yes) );};
destination messages	{ file("/var/log/messages" create_dirs(yes) );};
destination console	{ usertty("root");};
destination console_all { file("/dev/tty12" create_dirs(yes) );};
#destination loghost	{ udp("loghost" port(999)); };

destination xconsole 	{ pipe("/dev/xconsole"); };


##
# *** Filters
# http://www.balabit.hu/static/syslog-ng/reference/x567.html 
##

#

filter f_named		{ match("named"); };
filter f_postfix	{ match("postfix"); };
filter f_proftpd	{ match("proftpd"); };
filter f_sshd		{ match("sshd"); };
filter f_imap		{ match("imapd"); };
filter f_pop3		{ match("pop3"); };
filter f_syslogng	{ match("syslog-ng"); };
filter f_full 		{ not filter(f_named) 
			  and not filter(f_postfix); 
};

# default

filter f_auth 		{ facility(auth); };
filter f_authpriv 	{ facility(auth, authpriv); };
filter f_syslog 	{ not facility(authpriv, mail) 
			  and not filter(f_named)
			  and not filter(f_postfix); 
};
filter f_cron 		{ facility(cron); };
filter f_daemon 	{ facility(daemon) 
			  and not filter(f_named)
			  and not filter(f_postfix); 
};
filter f_kern 		{ facility(kern); };
filter f_lpr 		{ facility(lpr); };
filter f_mail 		{ facility(mail); };
filter f_user 		{ facility(user); };
filter f_uucp 		{ facility(cron); };
# In general - peoples don't have ppp facility in kernel - if yes - uncoment this
#filter f_ppp 		{ facility(ppp); };
filter f_news 		{ facility(news); };
filter f_debug 		{ not facility(auth, authpriv, news, mail) 
			  and not filter(f_named)
			  and not filter(f_postfix); 
};

filter f_messages { 
    level(info..warn) 
    and not facility(auth, authpriv, mail, news)
    and not filter(f_named)
    and not filter(f_postfix); 
};

filter f_emergency 	{ level(emerg); };

filter f_info 		{ level(info); };
filter f_notice 	{ level(notice); };
filter f_warn 		{ level(warn); };
filter f_crit 		{ level(crit); };
filter f_err 		{ level(err); };


##
# *** Connections between filters and destinations
# http://www.balabit.hu/static/syslog-ng/reference/logpath.html 
##

#

log { source(src); destination(d_full); };
log { source(src); filter(f_full); destination(d_fullhosts); };
log { source(s_kern); destination(d_kern); };
log { source(src); filter(f_proftpd); destination(d_proftpd); };
log { source(src); filter(f_postfix); destination(d_postfix); };
log { source(src); filter(f_syslogng); destination(d_syslogng); };
log { source(src); filter(f_sshd); destination(d_sshd); };
log { source(src); filter(f_imap); destination(d_imap); };
log { source(src); filter(f_pop3); destination(d_pop3); };
log { source(src); filter(f_named); destination(d_named); };

# defaults

log { source(src); filter(f_authpriv); destination(authlog); };
#log { source(src); filter(f_syslog); destination(syslog); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_daemon);  destination(daemon); };
log { source(src); filter(f_kern); destination(kern); };
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_user); destination(user); };
log { source(src); filter(f_uucp); destination(uucp); };
log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };
log { source(src); filter(f_news); filter(f_crit); destination(newscrit); };
log { source(src); filter(f_news); filter(f_err); destination(newserr); };
log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); };
log { source(src); filter(f_debug); destination(debug); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };
# In general - peoples don't have ppp facility in kernel - if yes - uncoment this
#log { source(src); filter(f_ppp); destination(ppp); };
log { source(src); destination(console_all); };


