[syslog-ng] NetScreen Statistics

[lists at grounded.net]

> Please, could you at least show your config? There is no default
> syslog-ng config. You should either write your own or copy one
> of the example configs from the tarball and customise it.

Of course, I don't have a problem providing info, just wasn't sure what to provide so was hoping someone would ask :). I'll paste it at the end of this. This was the default config which was put into /etc when I installed this package. 

> Also it would be quite useful for syslog-ng newbies to read the
> included reference guide for getting familiar with syslog-ng.

You know, sometimes you can read everything there is but just getting a little hands on opens all the doors to learning from there. I know the basics of linux syslog and have seen various examples of configurations but I've not figured out the config recipe method yet. 
 
> BTW if you're concerned about logging then you shouldn't use
> UDP at all.

I would not be looking at logging if I was concerned about logging on either TCP or UDP. Not sure what you mean by this?

 more /etc/syslog-ng.conf
options {
        sync (0);
        time_reopen (10);
        log_fifo_size (1000);
        long_hostnames (off);
        use_dns (no);
        use_fqdn (no);
        create_dirs (no);
        keep_hostname (yes);
};

source s_sys {
        file ("/proc/kmsg" log_prefix("kernel: "));
        unix-stream ("/dev/log");
        internal();
udp(ip(0.0.0.0) port(514));
};

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog" sync(10)); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_kern { file("/var/log/kern"); };
destination d_mlal { usertty("*"); };

filter f_filter1   { facility(kern); };
filter f_filter2   { level(info..emerg) and
                     not (facility(mail)
                       or facility(authpriv)
                       or facility(cron)); };
filter f_filter3   { facility(authpriv); };
filter f_filter4   { facility(mail); };
filter f_filter5   { level(emerg); };
filter f_filter6   { facility(uucp) or
                     (facility(news)
                       and level(crit..emerg)); };
filter f_filter7   { facility(local7); };
filter f_filter8   { facility(cron); };

#log { source(s_sys); filter(f_filter1); destination(d_cons); };
log { source(s_sys); filter(f_filter1); destination(d_kern); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_auth); };
log { source(s_sys); filter(f_filter4); destination(d_mail); };
log { source(s_sys); filter(f_filter5); destination(d_mlal); };
log { source(s_sys); filter(f_filter6); destination(d_spol); };
log { source(s_sys); filter(f_filter7); destination(d_boot); };
log { source(s_sys); filter(f_filter8); destination(d_cron); };

# vim: syntax=syslog-ng