#############################################################################
# Default syslog-ng.conf file which collects all local logs into a
# single file called /var/log/messages.
#
@version: 3.3
@include "scl.conf"
source s_local {
system();
internal();
};
source s_remote {
udp(ip(0.0.0.0) port(514));
tcp(ip(0.0.0.0) port(514));
};
destination d_separatedbyhosts {
file("/var/log/syslog-ng/$HOST/messages" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)
template("$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$S_SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n")
template_escape(yes)
);
};
log {
source(s_remote);
# uncomment this line to open port 514 to receive messages
#source(s_network);
destination(d_separatedbyhosts);
};
# <lzconfig> BEGIN LogZilla v3.2 syslog-ng config file
# Please don't remove the lzconfig tags above and at the end of this block.
#
# NOTE:
# You may need to alter your receive buffer if you expect a large amount of logs!
# Example: udp( so_rcvbuf(1048576));
#
#
###########################################################################################
# BEGIN LogZilla Config for syslog-ng
###########################################################################################
# Last updated on 2011-11-20
###########################################################################################
options {
# long_hostnames(off);
# doesn't actually help on Solaris, log(3) truncates at 1024 chars
log_msg_size(8192);
# buffer just a little for performance
# sync(1); <- Deprecated - use flush_lines() instead
flush_lines(1);
# memory is cheap, buffer messages unable to write (like to loghost)
log_fifo_size(16384);
# Hosts we don't want syslog from
#bad_hostname("^(ctld.|cmd|tmd|last)$");
# The time to wait before a dead connection is reestablished (seconds)
time_reopen(10);
#Use DNS so that our good names are used, not hostnames
use_dns(yes);
dns_cache(yes);
#Use the whole DNS name
use_fqdn(yes);
keep_hostname(yes);
# chain_hostnames(no);
#Read permission for everyone
perm(0644);
# The default action of syslog-ng 1.6.0 is to log a STATS line
# to the file every 10 minutes. That's pretty ugly after a while.
# Change it to every 12 hours so you get a nice daily update of
# # how many messages syslog-ng missed (0).
# stats(43200);
};
# Note: LogZilla will ONLY process log entries in the format below.
# You can't run
db_insert.pl on any log file without using this template.
# The reason is that messages vary in composition so the tab delimiters are
# needed to determine the tokens.
destination d_logzilla {
template("$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$S_SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n")
template_escape(yes)
);
};
destination df_logzilla {
file("/var/log/logzilla/DEBUG.log"
template("$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n")
template_escape(yes)
);
};
# Tell syslog-ng to log to our new destination
log {
source(s_remote);
destination(d_logzilla);
# Uncomment below and restart syslog-ng for debugging
destination(df_logzilla);
};
# END LogZilla Config for syslog-ng
###########################################################################################
# </lzconfig> END LogZilla v3.2 syslog-ng config file