@version: 3.3 options { log_fifo_size(1000000); # must be at least the biggest value of any log_is_size use_fqdn(yes); keep_hostname(yes); chain_hostnames(yes); time_reap(60); time_reopen(5); flush_lines(1000); flush_timeout(1000); }; source test { pipe("/var/log/syslog.pipes/test" log_fetch_limit(50) log_iw_size(10000) flags(no-parse) ); }; source int { internal(); }; template t_standardfile { template("$S_ISODATE $FULLHOST $FACILITY.$LEVEL $MSGHDR][$PROGRAM][$MESSAGE\n"); template_escape(no); }; destination localsyslog { tcp("localhost" port(1514) localip(catamount.comp.uvic.ca) log_fifo_size(5000) template("<$PRI>$S_ISODATE test@$HOST flexfilter_alert: $MSGONLY\n") template_escape(no) ); }; destination flexfilter { program("/usr/local/sbin/flexfilter /home1l/erempel/alert/fullsyslog.xml" template("$MESSAGE\n") template_escape(no) ); }; destination flexfilter2 { program("/bin/cat > /dev/null" template("$MESSAGE\n") template_escape(no) ); }; log { source(test); destination(flexfilter); flags(flow-control); }; log { source(int); destination(localsyslog); };