syslogd.pid"
# cat /etc/syslog-ng/syslog-ng.conf
@version:3.6
options {
flush_lines (0);
time_reopen (10);
log_fifo_size (20000);
use_dns (yes);
use_fqdn (yes);
create_dirs (yes);
dir_group("wheel");
dir_owner("nobody");
dir_perm(0755);
owner("nobody");
group("nobody");
perm(0644);
threaded(yes);
keep_hostname (yes);
chain_hostnames(yes);
bad_hostname("[^[:print:]]");
dns_cache(yes);
dns_cache_expire(300);
dns_cache_expire_failed(30);
dns_cache_size(1000);
stats_freq(3600);
flush_lines(0);
};
source s_sys {
file ("/proc/kmsg" program_override("kernel: "));
unix-stream ("/dev/log");
# udp(ip(0.0.0.0) port(514));
};
source s_tcp {
network(transport("tcp") port(514) so_rcvbuf(8388608) max-connections(200) log-iw-size(20000));
};
source s_udp {
network(transport("udp") port(514) so_rcvbuf(8388608) log-iw-size(20000));
};
source s_net {
network(transport("udp") port(515) so_rcvbuf(8388608) log-iw-size(20000) tags("source_net"));
network(transport("tcp") port(515) so_rcvbuf(8388608) max-connections(200) log-iw-size(20000) tags("source_net"));
};
source s_windows {
network(transport("tcp") port(516) so_rcvbuf(8388608) max-connections(200) log-iw-size(20000) tags("windows"));
};
destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog" flush_lines(10)); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_kern { file("/var/log/kern"); };
destination d_mlal { usertty("*"); };
destination d_userx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/user.log"); };
destination d_kernx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/kern.log"); };
destination d_mailx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/mail.log"); };
destination d_mp { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/mp.log"); };
destination d_daemonx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/daemon.log"); };
destination d_authx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/auth.log"); };
destination d_lprx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/lpr.log"); };
destination d_cronx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/cron.log"); };
destination d_messagesx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/messages.log"); };
destination d_networkx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/network.log"); };
destination d_firewallx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/firewall.log"); };
destination d_local0 { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/sp.log"); };
destination d_local1 { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/app.log"); };
destination d_localx { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/local.log"); };
destination d_local6 { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/httpd.log"); };
destination d_dnslogs { file("/u1/syslog/$HOST/$YEAR$MONTH$DAY/dnslogs.log"); };
destination d_logstash {
tcp("127.0.0.1" port(5140)
template("$R_ISODATE <$FACILITY_NUM.$LEVEL_NUM> $HOST $MSGHDR $MESSAGE\n")
frac_digits(3) template-escape(no));
pipe("/var/log/logstash-pipe"
template("$R_ISODATE <$FACILITY_NUM.$LEVEL_NUM> $HOST $MSGHDR $MESSAGE\n")
frac_digits(3) template-escape(no));
};
destination d_userauth {
};
destination d_otto {
};
destination d_notifier {
tcp("10.255.xx.yy" port(1248));
};
destination d_graylog {
pipe("/var/log/graylog-pipe" ts-format(iso));
};
destination d_gtsadfeed {
};
filter f_kernel { facility(kern); };
filter f_default { level(info..emerg)
and not (facility(mail)
or facility(authpriv)
or facility(cron))
and not message("Syslog connection (accepted|closed)"); };
filter f_auth { facility(auth,authpriv); };
filter f_mail { facility(mail); };
filter f_emergency { level(emerg); };
filter f_news { facility(uucp) or
(facility(news)
and level(crit..emerg)); };
filter f_boot { facility(local7); };
filter f_cron { facility(cron,solaris-cron); };
filter f_user { facility(user); };
filter f_daemon { facility(daemon); };
filter f_lpr { facility(lpr); };
filter f_dnslogs { program("mydns_logger"); };
filter f_local0 { facility(local0); };
filter f_local1 { facility(local1) and not program("mydns_logger"); };
filter f_local2 { facility(local2); };
filter f_local3 { facility(local3); };
filter f_local4 { facility(local4); };
filter f_local5 { facility(local5) or tags("source_net"); }; # local5 is network, so is port 515
filter f_local6 { facility(local6); };
filter f_local7 { facility(local7); };
filter f_alert { level(alert); };
filter f_crit { level(crit); };
filter f_err { level(err); };
filter f_warn { level(warn); };
filter f_notice { level(notice); };
filter f_info { level(info); };
filter f_debug { level(debug); };
filter f_nonet { not facility(local4) and not facility(local5) and not tags("source_net"); };
filter f_nocf3 { not program("cf3"); };
filter f_nodhcpd { not program("dhcpd"); };
filter f_windows { tags("windows"); };
filter f_snmptrapd { program("snmptrapd"); };
filter f_userauth { not facility(local3); };
filter f_notifier_filter { not match("ASA-4-302015|ASA-4-302013|TRAFFIC|permitted|Deny|Denied|denied", value("MESSAGE")); };
filter f_gtsadfeed_filter { host("*-adc*.
abc.xyz.com" type(glob)); };
rewrite f_rewrite_name { set("$FULLHOST_FROM", value("HOST")
condition(not tags("windows")
and not match("REMOTELOG", value("MESSAGE")))); };
rewrite r_rewrite_name_windows { set("$FULLHOST_FROM", value("HOST")
condition(not match("REMOTELOG", value("MESSAGE")))); };
rewrite r_snmptrapd { subst("^([^ ]+) (.*)", "${2}", value("MESSAGE"));
set("${1}", value("HOST")); };
log { source(s_sys); filter(f_kernel); destination(d_kern); };
log { source(s_sys); filter(f_default); destination(d_mesg); };
log { source(s_sys); filter(f_auth); destination(d_auth); };
log { source(s_sys); filter(f_mail); destination(d_mail); };
log { source(s_sys); filter(f_emergency); destination(d_mlal); };
log { source(s_sys); filter(f_news); destination(d_spol); };
log { source(s_sys); filter(f_boot); destination(d_boot); };
log { source(s_sys); filter(f_cron); destination(d_cron); };
log {
source(s_sys);
filter(f_snmptrapd);
rewrite(r_snmptrapd);
destination(d_networkx);
destination(d_logstash);
log {
filter(f_notifier_filter);
destination(d_notifier);
};
};
log {
source(s_net);
source(s_udp);
source(s_tcp);
source(s_sys);
source(s_windows);
log {
filter(f_userauth);
destination(d_userauth);
destination(d_otto);
};
log {
rewrite(f_rewrite_name);
log {
destination(d_logstash);
};
log {
filter(f_nocf3);
filter(f_nodhcpd);
destination(d_graylog);
};
log {
filter(f_user);
destination(d_userx);
};
log {
filter(f_kernel);
destination(d_kernx);
};
log {
filter(f_mail);
destination(d_mailx);
};
log {
filter(f_daemon);
destination(d_daemonx);
};
log {
filter(f_auth);
destination(d_authx);
};
log {
filter(f_lpr);
destination(d_lprx);
};
log {
filter(f_cron);
destination(d_cronx);
};
log {
filter(f_local0);
destination(d_local0);
};
log {
filter(f_local1);
destination(d_local1);
};
log {
filter(f_local2);
destination(d_authx);
};
log {
filter(f_dnslogs);
destination(d_dnslogs);
};
log {
filter(f_local4);
destination(d_firewallx);
log {
filter(f_notifier_filter);
destination(d_notifier);
};
};
log {
filter(f_local5);
destination(d_networkx);
log {
filter(f_notifier_filter);
destination(d_notifier);
};
};
log {
filter(f_local6);
destination(d_local6);
};
log {
filter(f_local7);
destination(d_mp);
};
log {
filter(f_windows);
filter(f_gtsadfeed_filter);
rewrite(r_rewrite_name_windows);
destination(d_gtsadfeed);
};
};
};