Greetings;
My setup works well with one exception, my
filtering rules contained in my syslog-ng.conf do not appear to work
properly. My logs are not lost, instead they end up in a directory which I
did not intend them to be in.
Background: I log to a MySql DB, flatfiles
and finally, to SEC, which parses stuff and takes various actions (almost
working ;-)
For ease of reading, I will simply add the contents of my
config file which pertains to just one filter.
Many thanks in advance for taking the time to read and help
me.
.vp
############
# OPTIONS
#
############
options
{
chain_hostnames(no);
create_dirs
(yes);
dir_perm(0755);
use_dns
(yes);
dns_cache(yes);
dns_cache_size(1000);
dns_cache_expire(604800);
keep_hostname(yes);
log_fifo_size(10000);
log_msg_size(8192);
long_hostnames(on);
perm(0644);
stats(3600);
sync(0);
time_reopen
(10);
use_dns(yes);
use_fqdn(yes);
};
############
#
SOURCES #
############
source
S_dgram
{ unix-dgram("/dev/log"); };
source
S_internal
{ internal(); };
source S_kernel
{
file("/proc/kmsg" log_prefix("kernel: ")); };
source S_tcp
{
tcp(port(4800) keep-alive(yes) max_connections(100)); };
source S_udp {
udp(ip("0.0.0.0") port(514)); };
###############
# DEST SQL
DB
#
###############
destination D_db_mysql
{
pipe("/var/log/mysql.pipe"
template("INSERT INTO
logs
(host, facility, priority, level, tag, datetime, program,
msg)
VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY
$HOUR:$MIN:$SEC',
'$PROGRAM', '$MSG' );\n")
template-escape(yes));
};
##############
#
DESTINATIONS #
##############
destination
D_authlog { file("/var/log/auth.log");
};
destination D_bootlog {
file("/var/log/boot.log"); };
destination
D_debug {
file("/var/log/debug"); };
destination
D_explan {
file("/var/log/explanations"); };
destination D_messages {
file("/var/log/messages"); };
destination
D_secure { file("/var/log/secure");
};
destination D_spooler {
file("/var/log/spooler"); };
destination
D_syslog { file("/var/log/syslog");
};
destination
D_user {
file("/var/log/user.log"); };
destination
D_switch {
file("/var/log/MyHosts/Switches/$FULLHOST.log"
perm(0644)); };
destination
D_edge {
file("/var/log/MyHosts/EdgeDevices/$FULLHOST.log"
perm(0644)); };
destination D_firewall {
file("/var/log/MyHosts/Firewalls/$FULLHOST.log"
owner(root) group(root) perm(0644) dir_perm(0700) create_dirs(yes));
};
destination D_router {
file("/var/log/MyHosts/Routers/$FULLHOST.log"
perm(0644)); };
destination D_accesspoints {
file("/var/log/MyHosts/AccessPoints/$FULLHOST.log"
perm(0644)); };
destination D_mailservers {
file("/var/log/MyHosts/MailServers/$FULLHOST.log"
perm(0644)); };
###########
#
FILTERS
#
###########
filter
F_auth { facility(auth,
authpriv); };
filter
F_authpriv { facility(authpriv);
};
filter
F_cron { facility(cron);
};
filter
F_daemon { facility(daemon);
};
filter
F_kern { facility(kern);
};
filter
F_local1 { facility(local1);
};
filter
F_local2 { facility(local2);
};
filter
F_local3 { facility(local3);
};
filter
F_local4 { facility(local4);
};
filter
F_local5 { facility(local5);
};
filter
F_local6 { facility(local6);
};
filter
F_local7 { facility(local7);
};
filter
F_lpr { facility(lpr);
};
filter
F_mail { facility(mail);
};
filter F_messages {
facility(daemon, kern, user); };
filter
F_news { facility(news);
};
filter
F_spooler { facility(uucp,news) and level(crit);
};
filter
F_syslog { not facility(auth, authpriv) and
not facility(mail); };
filter
F_user { facility(user);
};
filter
F_crit { level(crit);
};
filter
F_debug { level(debug);
};
filter F_emergency {
level(emerg); };
filter
F_err { level(err);
};
filter
F_info { level(info);
};
filter
F_notice { level(notice);
};
filter
F_warn { level(warn);
};
filter F_edge {
host("edge*") or host("122.21.*"); };
filter
F_router { host("gw*") or host("rtr") or
host("mmsc"); };
filter F_switch {
host("sw*") or host("sw1") or host("sw2"); };
filter
F_firewall { host("^fw*") or host("^mlm*-*") or
host("^cm*"); };
filter
F_dc {
host("^mydc*") or host("^dc*"); };
filter F_accesspoints { host("^melanie*");
};
filter F_mailservers { host("^mail*") or host("^smtpgw*");
};
filter F_proxies { host("^proxygw*");
};
filter F_InternetIP { host("161.17.10.*");
};
##############
#
LOGS
#
##############
log { source(S_udp); destination(D_db_mysql);
};
# Send ALL logs to SEC
# log { source(S_dgram);
source(S_internal); source(S_tcp); filter(F_auth); destination(D_sec);
};
# log { source(S_udp); source(S_tcp); destination(D_sec);
};
log { source(S_udp); destination(D_sec); };
###
log {
source(S_dgram);
source(S_internal);
source(S_tcp);
filter(F_auth); destination(D_authlog);
flags(final); };
log { source(S_dgram);
source(S_internal);
source(S_tcp); filter(F_local7);
destination(D_bootlog); flags(final); };
log {
source(S_dgram);
source(S_internal);
source(S_tcp); filter(F_local1);
destination(D_explan); flags(final); };
log {
source(S_dgram);
source(S_internal);
source(S_tcp); filter(F_local5);
destination(D_router); flags(final); };
log {
source(S_dgram);
source(S_internal);
source(S_tcp); filter(F_messages);
destination(D_messages); flags(final); };
log {
source(S_dgram);
source(S_internal);
source(S_tcp); filter(F_authpriv);
destination(D_secure); flags(final); };
log {
source(S_dgram);
source(S_internal);
source(S_tcp); filter(F_spooler);
destination(D_spooler); flags(final); };
log {
source(S_dgram);
source(S_internal);
source(S_kernel);
source(S_tcp); filter(F_syslog);
destination(D_syslog); flags(final); };
log {
source(S_dgram);
source(S_internal);
source(S_tcp);
filter(F_user); destination(D_user); flags(final);
};
log { source(S_dgram);
source(S_internal);
source(S_kernel);
source(S_tcp);
destination(D_hosts); flags(final); };
log { source(S_udp);
filter(F_switch); destination(D_switch); flags(final); };
log {
source(S_udp); filter(F_firewall); destination(D_firewall); flags(final);
};
log { source(S_udp); filter(F_router); destination(D_router);
flags(final); };
log { source(S_udp); filter(F_edge); destination(D_edge);
flags(final); };
log { source(S_udp); filter(F_dc); destination(D_dc);
flags(final); };
log { source(S_udp); filter(F_accesspoints);
destination(D_accesspoints); flags(final); };
log { source(S_udp);
filter(F_proxies); destination(D_proxies); flags(final); };
log {
source(S_udp); filter(F_mailservers); destination(D_mailservers); flags(final);
};
log { source(S_udp); destination(D_udp);};
<!--[if
!supportLineBreakNewLine]-->
<!--[endif]-->