<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Hello!</p>
<p><br>
</p>
<p>I am trying to build a syslog-ng.conf for a DMZ relay that will listen on several TCP and UDP ports, all working just great.</p>
<p>My config essentially captures traffic, then redirects each connection internally from itself.</p>
<p><br>
</p>
<p>What happens if my internal host goes down? I am hoping to store locally if connectivity is down, but not sure where or how that would get defined.</p>
<p><br>
</p>
<p>I need to keep a direct relationship between ports, as my internal syslog-ng treats these ports differently, so redirecting to the same as received is key.</p>
<p><br>
</p>
<p>Below is my DMZ relay syslog-NG config file, any offers to make it better greatly appreciated.<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>-Vadim</p>
<div>-------------------------syslog-ng.conf------------------------------</div>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">@version:3.5<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">@include "scl.conf"<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">@include "/etc/syslog-ng/conf.d/*.conf"<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">options {<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> time-reap(30);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> mark-freq(10);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> keep-hostname(yes);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> chain_hostnames (off);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> flush_lines (0);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> time_reopen (10);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> log_fifo_size (1000);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> use_dns (yes);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> use_fqdn (no);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> create_dirs (no);<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">};<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">source s_udp-relay {<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> udp(ip(0.0.0.0) port(514) so_rcvbuf(425984));
<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">};<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><br>
</p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">source s_tcp-relay-514 {<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> tcp(ip(0.0.0.0) port(514) max-connections(250) so_rcvbuf(425984) log_iw_size(25000) so_keepalive(yes) log_fetch_limit(100));<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">};<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"><u></u> <u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">source s_tcp-relay-7514 {<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"> tcp(ip(0.0.0.0) port(7514) max-connections(250) so_rcvbuf(425984) log_iw_size(25000) so_keepalive(yes) log_fetch_limit(100));<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">};<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">destination d_syslog_udp { udp("10.5.5.5" port(514)); };<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">destination d_syslog_tcp-514 { tcp("10.5.5.5" port(514)); };<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">destination d_syslog_tcp-7514 { tcp("10.5.5.5" port(7514)); };<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN"><u></u> <u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">log { source(s_udp-relay); destination(d_syslog_udp); };<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">log { source(s_tcp-relay-514); destination(d_syslog_tcp-514); };<u></u><u></u></span></p>
<p class="MsoNormal" style="line-height: 115%; margin-bottom: 10pt;"><span lang="EN">log { source(s_tcp-relay-7514); destination(d_syslog_tcp-7514)<wbr>; };</span></p>
<p><br>
</p>
<p><br>
</p>
<div> </div>
</div>
</body>
</html>