# ############################################################################# #
#                                                                               #
# Author: Meraz Nasir                                                           #
# email : mnasir@interfaithmedical.com   	                                #
# Comp  : Interfaith Medical Center                                             #
# Configuration Summary: Master configuration file for syslog-ng                #
# for Interfaith Medical syslog server.                                         #
#                                                                               #
# ############################################################################# #


 # ############################################################################ #
#                                                                                #
# OPTIONS: Defines the global properties for the syslog-ng daemon.               #
#                                                                                #
 # ############################################################################ #

 options 
{
        group(logs);
        dir_group(logs);

        perm(0640);
        dir_perm(0750);
        create_dirs(yes);
        use_time_recvd(yes);      # Use the time a message is received.
                                  # instead of the one specified in the message.

        sync(0);                  # The number of lines buffered before written.

        use_fqdn(no);             # Add Fully Qualified Domain Name instead of short host name.
        stats (7200);             # The number of seconds between two STATS.
        log_fifo_size(4096);      # The number of lines fitting to the output queue.
        keep_hostname(yes);       # Enable or disable hostname rewriting.
        chain_hostnames(no);      # Enable or disable chain hostname format.
        bad_hostname("gconfd");   # A regexp which matches hostnmes which should not be taken as such.
          
        gc_idle_threshold(500);    # Performance tuning, tuning Garbage collection thresholds.
        gc_busy_threshold(10000); # Performance tuning, tuning gc busy threshold.

};

 # ############################################################################ #
#                                                                                #
# SOURCE: Collection of sorce drivers, which collect messages using a given      #
# method, default (unix, linux) domain socket /dev/log or through tcp/udp socket #
#                                                                                #
 # ############################################################################ #

#   
# source s_local to capture all local system logs.
# unix-stream("/dev/log"): Linux local log socket. 
# internal(): To capture syslog-ng logs.
# max-connections(1000): Limits the number of simultaneously opened connections, only used with unix-stream().
# file("/proc/kmsg"): To capture kenel messages.
#

source s_local { unix-stream("/dev/log" max-connections(1000)); internal(); file("/proc/kmsg"); };


#
# source s_linux to open up socket 5140:tcp for collecting logs; reserved for linux servers
# tcp(ip(0.0.0.0) port(5140)): Listen on 5140 tcp socket on any interface
#

# RESERVED: source s_linux {tcp(ip(0.0.0.0) port(6140) max-connections(1000)); };


#
# source s_win to open up socket 5150:tcp for collecting logs; reserved for windows servers
# tcp(ip(0.0.0.0) port(5150)): Listen on 5150 tcp socket on any interface
#

# RESERVED: source s_win { tcp(ip(0.0.0.0) port(6150) max-connections(500)); };

#
# source s_network to open up socket 5141:tcp, 514:udp for collecting logs
# tcp(ip(0.0.0.0) port(5141)): Listen on 5141 tcp socket on any interface
# udp(ip(0.0.0.0) port(514)):  Listen on 514 udp socket on any interface
#

 source s_network { tcp(ip(0.0.0.0) port(5140) max-connections(1000)); udp(ip(0.0.0.0) port(514)); };


#
# source s_ups to open up socket 5141:tcp, 514:udp for collecting logs
# tcp(ip(0.0.0.0) port(5150)): Listen on 5150 tcp socket on any interface
# udp(ip(0.0.0.0) port(5150)):  Listen on 5150 udp socket on any interface
#

source s_ups { udp(ip(0.0.0.0) port(5140)); };

#
# source s_rpdu to open up socket 5141:tcp, 514:udp for collecting logs
# tcp(ip(0.0.0.0) port(5160)): Listen on 5160 tcp socket on any interface
# udp(ip(0.0.0.0) port(5160)):  Listen on 5160 udp socket on any interface
#

source s_rpdu { udp(ip(0.0.0.0) port(5140)); };



 # ############################################################################ #
#                                                                                #
# FILTERS: Performs log routine inside syslog-ng                                 #
#                                                                                #
 # ############################################################################ #


 # ############################################################################ #
#                                                                                #
# DESTINATION: Destination directory for the captured logs.                      #
#                                                                                #
 # ############################################################################ #

#
# mysql destination
#

destination d_mysql {
pipe("/tmp/mysql.pipe"
template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ('$HOST', '$FACILITY', '$PRIORITY', 
'$LEVEL', '$TAG',

'$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n")
template-escape(yes));

};


 # ############################################################################ #
#                                                                                #
# LOG: This co-relates the predifined source with destination                    #
#                                                                                #
 # ############################################################################ #


# 
# MySQL log drivers
log { source(s_local); source(s_network); source(s_ups); source(s_rpdu); destination(d_mysql); };
