{\rtf1\ansi\ansicpg1252\deff0\deflang1033{\fonttbl{\f0\fswiss\fcharset0 Arial;}}
{\*\generator Msftedit 5.41.15.1515;}\viewkind4\uc1\pard\f0\fs20 #\par
# /etc/syslog-ng/syslog-ng.conf\par
#\par
# Automatically generated by SuSEconfig on Sat Aug 15 12:16:03 EDT 2009.\par
#\par
# PLEASE DO NOT EDIT THIS FILE!\par
#\par
# you can modify /etc/syslog-ng/syslog-ng.conf.in instead\par
#\par
#\par
#\par
# File format description can be found in syslog-ng.conf(5)\par
# and /usr/share/doc/packages/syslog-ng/syslog-ng.txt.\par
#\par
\par
#\par
# Global options.\par
#\par
options \{ long_hostnames(off); sync(0); perm(0640); stats(3600); \};\par
\par
#\par
# 'src' is our main source definition. you can add\par
# more sources driver definitions to it, or define\par
# your own sources, i.e.:\par
#\par
#source my_src \{ .... \};\par
#\par
source src \{\par
        #\par
        # include internal syslog-ng messages\par
        # note: the internal() soure is required!\par
        #\par
        internal();\par
\par
        #\par
        # the following line will be replaced by the\par
        # socket list generated by SuSEconfig using\par
        # variables from /etc/sysconfig/syslog:\par
        #\par
        unix-dgram("/dev/log");\par
\par
        #\par
        # uncomment to process log messages from network:\par
        #\par
        udp(ip("0.0.0.0") port(514));\par
\};\par
\par
#\par
# Filter definitions\par
#\par
filter f_iptables   \{ facility(kern) and match("IN=") and match("OUT="); \};\par
\par
filter f_console    \{ level(warn) and facility(kern) and not filter(f_iptables)\par
                      or level(err) and not facility(authpriv); \};\par
\par
filter f_newsnotice \{ level(notice) and facility(news); \};\par
filter f_newscrit   \{ level(crit)   and facility(news); \};\par
filter f_newserr    \{ level(err)    and facility(news); \};\par
filter f_news       \{ facility(news); \};\par
\par
filter f_mailinfo   \{ level(info)      and facility(mail); \};\par
filter f_mailwarn   \{ level(warn)      and facility(mail); \};\par
filter f_mailerr    \{ level(err, crit) and facility(mail); \};\par
filter f_mail       \{ facility(mail); \};\par
\par
filter f_cron       \{ facility(cron); \};\par
\par
filter f_local      \{ facility(local0, local1, local2, local3,\par
                               local4, local5, local6, local7); \};\par
\par
filter f_acpid      \{ match('^\\[acpid\\]:'); \};\par
filter f_netmgm     \{ match('^NetworkManager:'); \};\par
\par
filter f_messages   \{ not facility(news, mail) and not filter(f_iptables); \};\par
filter f_warn       \{ level(warn, err, crit) and not filter(f_iptables); \};\par
filter f_alert      \{ level(alert); \};\par
\par
filter f_authpriv   \{ facility(authpriv); \};\par
\par
\par
#\par
# Most warning and errors on tty10 and on the xconsole pipe:\par
#\par
destination console  \{ pipe("/dev/tty10"    group(tty) perm(0620)); \};\par
log \{ source(src); filter(f_console); destination(console); \};\par
\par
destination xconsole \{ pipe("/dev/xconsole" group(tty) perm(0400)); \};\par
log \{ source(src); filter(f_console); destination(xconsole); \};\par
\par
# Enable this, if you want that root is informed immediately,\par
# e.g. of logins:\par
#\par
#destination root \{ usertty("root"); \};\par
#log \{ source(src); filter(f_alert); destination(root); \};\par
\par
\par
#\par
# News-messages in separate files:\par
#\par
destination newscrit   \{ file("/var/log/news/news.crit"\par
                              owner(news) group(news)); \};\par
log \{ source(src); filter(f_newscrit); destination(newscrit); \};\par
\par
destination newserr    \{ file("/var/log/news/news.err"\par
                              owner(news) group(news)); \};\par
log \{ source(src); filter(f_newserr); destination(newserr); \};\par
\par
destination newsnotice \{ file("/var/log/news/news.notice"\par
                              owner(news) group(news)); \};\par
log \{ source(src); filter(f_newsnotice); destination(newsnotice); \};\par
\par
#\par
# and optionally also all in one file:\par
# (don't forget to provide logrotation config)\par
#\par
#destination news \{ file("/var/log/news.all"); \};\par
#log \{ source(src); filter(f_news); destination(news); \};\par
\par
\par
#\par
# Mail-messages in separate files:\par
#\par
destination mailinfo \{ file("/var/log/mail.info"); \};\par
log \{ source(src); filter(f_mailinfo); destination(mailinfo); \};\par
\par
destination mailwarn \{ file("/var/log/mail.warn"); \};\par
log \{ source(src); filter(f_mailwarn); destination(mailwarn); \};\par
\par
destination mailerr  \{ file("/var/log/mail.err" fsync(yes)); \};\par
log \{ source(src); filter(f_mailerr);  destination(mailerr); \};\par
\par
#\par
# and also all in one file:\par
#\par
destination mail \{ file("/var/log/mail"); \};\par
log \{ source(src); filter(f_mail); destination(mail); \};\par
\par
 \par
#\par
# acpid messages in one file:\par
#\par
destination acpid \{ file("/var/log/acpid"); \};\par
log \{ source(src); filter(f_acpid); destination(acpid); flags(final); \};\par
\par
#\par
# NetworkManager messages in one file:\par
#\par
destination netmgm \{ file("/var/log/NetworkManager"); \};\par
log \{ source(src); filter(f_netmgm); destination(netmgm); flags(final); \};\par
\par
\par
#\par
# Cron-messages in one file:\par
# (don't forget to provide logrotation config)\par
#\par
#destination cron \{ file("/var/log/cron"); \};\par
#log \{ source(src); filter(f_cron); destination(cron); \};\par
\par
\par
#\par
# Some boot scripts use/require local[1-7]:\par
#\par
destination localmessages \{ file("/var/log/localmessages"); \};\par
log \{ source(src); filter(f_local); destination(localmessages); \};\par
\par
\par
#\par
# All messages except iptables and the facilities news and mail:\par
#\par
destination messages \{ file("/var/log/messages"); \};\par
log \{ source(src); filter(f_messages); destination(messages); \};\par
\par
\par
#\par
# Firewall (iptables) messages in one file:\par
#\par
destination firewall \{ file("/var/log/firewall"); \};\par
log \{ source(src); filter(f_iptables); destination(firewall); \};\par
\par
\par
#\par
# Warnings (except iptables) in one file:\par
#\par
destination warn \{ file("/var/log/warn" fsync(yes)); \};\par
log \{ source(src); filter(f_warn); destination(warn); \};\par
\par
#\par
# Enable this, if you want to keep all messages in one file:\par
# (don't forget to provide logrotation config)\par
#\par
#destination allmessages \{ file("/var/log/allmessages"); \};\par
#log \{ source(src); destination(allmessages); \};\par
}
