###############################################################
# First, set some global options.

options {
use_fqdn(yes);
use_dns(yes);
dns_cache(yes);
keep_hostname(yes);
long_hostnames(off);
sync(1);
log_fifo_size(1024);
};

###############################################################
#
# Logs may come from unix stream, and UDP:514
#
source src {
pipe("/proc/kmsg");
unix-stream("/dev/log");
internal();
udp(ip("192.168.2.3") port(514));
tcp(ip("192.168.2.3") port(514) keep-alive(yes));
};

###############################################################
# First some standard logfile
#

destination authlog { file("/var/log/auth.log"); };
destination syslog { file("/var/log/syslog"); };
destination cron { file("/var/log/cron.log"); };
destination daemon { file("/var/log/daemon.log"); };
destination user { file("/var/log/user.log"); };
#destination debug { file("/var/log/debug"); };
destination messages { file("/var/log/messages"); };

##########################################
# Here's the filter options. With this rules, we can set which
# message go where.

filter f_authpriv { facility(auth, authpriv); };
filter f_syslog { not facility(auth, authpriv) and not facility(mail); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
#filter f_mail { facility(mail); };
filter f_user { facility(user); };
#filter f_news { facility(news); };
#filter f_debug { not facility(auth, authpriv, news, mail); };
filter f_messages { level(info .. warn)
       and not facility(auth, authpriv, cron, daemon, mail, news); };
filter f_emergency { level(emerg); };
filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };

###############################################################
#
# log statements actually send logs somewhere, to a file, across the network, etc
#

log { source(src); filter(f_authpriv); destination(authlog); };
log { source(src); filter(f_authpriv); destination(std); };
log { source(src); filter(f_syslog); destination(std); };
log { source(src); filter(f_cron); destination(std); };
log { source(src); filter(f_daemon); destination(std); };
log { source(src); filter(f_daemon); destination(std); };
log { source(src); filter(f_kern); destination(std); };
log { source(src); filter(f_user); destination(std); };
#log { source(src); filter(f_debug); destination(std); };
log { source(src); filter(f_messages); destination(std); };

## set up logging to loghost
#destination loghost {
# tcp("10.0.0.1" port(514));
#};

# send everything to loghost, too
#log {
# source(src);
# destination(loghost);
#};

#
# automatic host sorting (usually used on a loghost)
#
# set it up
destination std {
file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY"
owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)
);
};

# log it
log {
source(src);
destination(std);
};