Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. @version: 3.3
  2. @include "scl.conf"
  3.  
  4. #
  5. # see http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/index.html
  6. #
  7.  
  8. ##
  9. ## global options
  10. ##
  11. ## see http://www.balabit.com/dl/html/syslog-ng-v3.3-guide-admin-en.html/ch08s09.html
  12. ##
  13.  
  14. options {
  15.    
  16.     ## general settings
  17.     time_reopen(10); # Reopen a dead connection after this many seconds
  18.     time_reap(120); # Close an idle destination file after this many seconds
  19.     ts_format(rfc3164); # Timestamp format: rfc3164|rfc3339|bsd|iso
  20.     log_fifo_size(1000000); # Output queue size
  21.     log_msg_size(8192); # Max size of a single message
  22.     flush_lines(10); # Buffer this many lines of output (0 to send to disk immediately)
  23.     flush_timeout(1000); # Wait at most this many milliseconds before forcibly flushing the output buffer
  24.     mark_freq(300); # MARK line logging interval
  25.     stats_freq(0); # Stats logging interval (0 = disabled)
  26.     ## remote logging
  27.     normalize_hostnames(yes); # Do normalize hostnames (transform to lower case)
  28.     chain_hostnames(on); # Chain hostnames?
  29.     keep_hostname(yes); # Keep the hostname the client sent?
  30.     keep_timestamp(no); # Do not use the timestamp the client sent -- it might be wrong
  31.     use_dns(yes); # Use DNS? Good for log servers.
  32.     use_fqdn(no); # Use FQDNs? Good for log servers.
  33.     dns_cache(yes); # Cache DNS results?
  34.     dns_cache_size(1024); # Number of DNS lookup results to cache
  35.     dns_cache_expire(3600); # Expire cached successful DNS lookup results after this many seconds
  36.     dns_cache_expire_failed(60); # Expire cached failed DNS lookup results after this many seconds
  37.    
  38.     ## log file handling
  39.     create_dirs(yes); # Create directories for log files if they don't exist
  40.     dir_owner("root"); # Owner of newly created directories
  41.     dir_group("adm"); # Group of newly created directories
  42.     dir_perm(0750); # Permissions of newly created directories
  43.     owner("root"); # Owner of newly created log files
  44.     group("adm"); # Group of newly created log files
  45.     perm(0640); # Permissions of newly created log files
  46.  
  47.     ## misc
  48.     # Some program send log messages through a private implementation.
  49.     # and sometimes that implementation is bad. If this happen syslog-ng
  50.     # may recognise the program name as hostname. Whit this option
  51.     # we tell the syslog-ng that if a hostname match this regexp than that
  52.     # is not a real hostname.
  53.     bad_hostname("^gconfd$");
  54.  
  55. };
  56.  
  57. ##
  58. ## filters
  59. ##
  60. ## see http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch03s06.html
  61. ##
  62.  
  63. ## standard syslog facilities
  64. filter f_kern     { facility(kern);     };
  65. filter f_auth     { facility(auth);     }; # -- note: 'security' is a deprecated alias
  66. filter f_authpriv { facility(authpriv); };
  67. filter f_syslog   { facility(syslog);   };
  68. filter f_daemon   { facility(daemon);   };
  69. filter f_cron     { facility(cron);     };
  70. filter f_ftp      { facility(ftp);      };
  71. filter f_lpr      { facility(lpr);      };
  72. filter f_mail     { facility(mail);     };
  73. filter f_news     { facility(news);     };
  74. filter f_uucp     { facility(uucp);     };
  75. filter f_user     { facility(user);     };
  76. filter f_local0   { facility(local0);   };
  77. filter f_local1   { facility(local1);   };
  78. filter f_local2   { facility(local2);   };
  79. filter f_local3   { facility(local3);   };
  80. filter f_local4   { facility(local4);   };
  81. filter f_local5   { facility(local5);   };
  82. filter f_local6   { facility(local6);   };
  83. filter f_local7   { facility(local7);   };
  84.  
  85. ## standard syslog priorities: "exactly"
  86. filter f_emerg    { priority(emerg);          }; # 0 -- note: 'panic' is a deprecated alias
  87. filter f_alert    { priority(alert);          }; # 1
  88. filter f_crit     { priority(crit);           }; # 2
  89. filter f_err      { priority(err);            }; # 3 -- note: 'error' is a deprecated alias
  90. filter f_warning  { priority(warning);        }; # 4 -- note: 'warn' is a deprecated alias
  91. filter f_notice   { priority(notice);         }; # 5
  92. filter f_info     { priority(info);           }; # 6
  93. filter f_debug    { priority(debug);          }; # 7
  94.  
  95. ## standard syslog priorities: "at least"
  96. filter f_alert+   { priority(alert..emerg);   }; # 1-0
  97. filter f_crit+    { priority(crit..emerg);    }; # 2-0
  98. filter f_err+     { priority(err..emerg);     }; # 3-0
  99. filter f_warning+ { priority(warning..emerg); }; # 4-0
  100. filter f_notice+  { priority(notice..emerg);  }; # 5-0
  101. filter f_info+    { priority(info..emerg);    }; # 6-0
  102. filter f_debug+   { priority(debug..emerg);   }; # 7-0
  103.  
  104. ##
  105. ## templates for the log messages
  106. ##
  107. ## see http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch03s07.html
  108. ##
  109. ## WARNING: syslog logfile analysis tools might stumble over non-standard
  110. ## formats! tools like mailgraph and tenshi just come to mind.
  111. ##
  112. ## for tenshi, it's easy to circumvent problems by either using the standard
  113. ## format for the tenshi fifo or by using the "logprefix" feature in tenshi.conf
  114. ## to match the custom format, e.g. when using facility and priority as alerting
  115. ## criteria.
  116. ##
  117. ## mailgraph probably needs to be patched for being able to deal with a
  118. ## non-standard log message format.
  119. ##
  120.  
  121. # macro quick-reference:
  122. # - DATE: "Jun 13 15:58:00" (default syslog date)
  123. # - FULLDATE: "2006 Jun 13 15:56:57"
  124. # - ISODATE: "2006-06-13T15:56:51+02:00"
  125. # - PRI: see http://www.faqs.org/rfcs/rfc3164.html, 4.1.1
  126. # - TZOFFSET: "+02:00"
  127.  
  128. ## default message format (standard syslog message format)
  129. #template t_default  { template("${DATE} ${HOST} ${MSGHDR}${MSG}\n"); template_escape(no); };
  130. ## default message format (standard syslog-ng-3.0 message format)
  131. template t_default  { template("${ISODATE} ${HOST} ${MSGHDR}${MSG}\n"); template_escape(no); };
  132.  
  133. ## log and admin console messagee formats
  134. template t_logtty   { template("${DATE}; ${FACILITY}.${PRIORITY}; ${MSGHDR}${MSG}\n"); template_escape(no); };
  135. template t_admintty { template("${DATE}; ${FACILITY}.${PRIORITY}; ${MSGHDR}${MSG}\n"); template_escape(no); };
  136.  
  137. ## custom local message format (used by default throughout this configuration, also see t_remote_r)
  138. template t_local    { template("${YEAR}-${MONTH}-${DAY} ${HOUR}:${MIN}:${SEC} ${TZOFFSET}; ${HOST}; ${FACILITY}.${PRIORITY}; ${MSGHDR}${MSG}\n"); templ
  139. ate_escape(no); };
  140.  
  141. ## tenshi message format (tenshi.conf needs to be adjusted for this format!)
  142. template t_tenshi   { template("${HOST}; ${FACILITY}.${PRIORITY}; ${MSGHDR}${MSG}\n"); template_escape(no); };
  143.  
  144. ## mailgraph message format
  145. template t_mgraph   { template("${DATE} ${HOST} ${MSGHDR}${MSG}\n"); template_escape(no); };
  146.  
  147. ## remote reception message format (replaces time information of received messages with local system time)
  148. template t_remote_r { template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${R_TZOFFSET}; ${HOST}/${SOURCEIP}; ${FACILITY}.${PRIORITY};
  149. ${MSGHDR}${MSG}\n"); template_escape(no); };
  150.  
  151. ## remote delivery message format (standard syslog protocol format)
  152. template t_remote_d { template("<${PRI}>${DATE} ${HOST} ${MSGHDR}${MSG}\n"); template_escape(no); };
  153.  
  154. ##
  155. ## local sources
  156. ##
  157. ## see http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch03s03.html
  158. ## and http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch08s01.html
  159. ##
  160.  
  161. ## local syslog messages + syslog-ng internal messages
  162. source s_local {
  163.     unix-stream("/dev/log");
  164.     #unix-stream("/dev/log" max-connections(1000));
  165.     internal();
  166. };
  167.  
  168. ## kernel messages
  169. source s_kernel {
  170.     file("/proc/kmsg" flags(kernel) program_override("kernel"));
  171. };
  172.  
  173. ##
  174. ## local destinations and log paths
  175. ##
  176. ## see http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch03s04.html
  177. ## and http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch03s05.html
  178. ## and http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch08s02.html
  179. ## and http://www.balabit.com/dl/html/syslog-ng-v3.0-guide-admin-en.html/ch08s03.html
  180. ##
  181.  
  182. #
  183. # discard messages
  184. #
  185.  
  186. ## example for discarding certain messages using an empty destination and the final flag
  187. #destination d_null { };
  188. #filter f_null { message("I am a message that wants to be discarded"); };
  189. #log { source(s_local); filter(f_null); destination(d_null); flags(final); };
  190.  
  191. #
  192. # system specials
  193. #
  194.  
  195. ## kernel messages
  196. destination d_kernel { file("/var/log/syslog-ng/kernel.log" template(t_local)); };
  197. log { source(s_kernel); destination(d_kernel); };
  198.  
  199. ## log console
  200. destination d_logtty { file("/dev/tty3" template(t_logtty)); };
  201. log { source(s_local); source(s_kernel); destination(d_logtty); };
  202.  
  203. ## admin console
  204. destination d_admintty { usertty("root"); };
  205. log { source(s_local); filter(f_emerg); destination(d_admintty); };
  206.  
  207. #
  208. # application specific
  209. #
  210.  
  211. ## firewall (iptables, using custom iptables log prefixes)
  212. destination d_firewall { file("/var/log/syslog-ng/firewall.log" template(t_local)); };
  213. filter f_firewall { message("^FW: ") or message("^ip4t_FW ") or message("^ip6t_FW "); };
  214. log { source(s_kernel); filter(f_firewall); destination(d_firewall); };
  215.  
  216. ## sudo
  217. destination d_sudo { file("/var/log/syslog-ng/sudo.log" template(t_local)); };
  218. filter f_sudo { program("^sudo$"); };
  219. log { source(s_local); filter(f_sudo); destination(d_sudo); };
  220.  
  221. ## sshd
  222. destination d_sshd { file("/var/log/syslog-ng/sshd.log" template(t_local)); };
  223. filter f_sshd { program("^sshd$") or program("^sftp-server$"); };
  224. log { source(s_local); filter(f_sshd); destination(d_sshd); };
  225.  
  226. ## cron
  227. destination d_cron { file("/var/log/syslog-ng/cron.log" template(t_local)); };
  228. filter f_cron { facility(cron); };
  229. log { source(s_local); filter(f_cron); destination(d_cron); };
  230.  
  231. ## ntpd
  232. destination d_ntpd { file("/var/log/syslog-ng/ntpd.log" template(t_local)); };
  233. filter f_ntpd { program("^ntpd$"); };
  234. log { source(s_local); filter(f_ntpd); destination(d_ntpd); };
  235.  
  236. ## named
  237. destination d_named { file("/var/log/syslog-ng/named.log" template(t_local)); };
  238. filter f_named { program("^named$"); };
  239. log { source(s_local); filter(f_named); destination(d_named); };
  240.  
  241. ## OpenLDAP SLAPD
  242. ## mark debug messages as final so they don't get into any other file
  243. destination d_slapd { file("/var/log/syslog-ng/slapd.log" template(t_local)); };
  244. filter f_slapd { program("^slapd$"); };
  245. log { source(s_local); filter(f_slapd); filter(f_debug); destination(d_slapd); flags(final); };
  246. log { source(s_local); filter(f_slapd); destination(d_slapd); };
  247.  
  248. ## PSAD
  249. destination psadpipe { pipe("/var/lib/psad/psadfifo"); };
  250. filter f_kerninfo { facility(kern); };
  251. log { source(s_local); filter(f_kerninfo); destination(psadpipe); };
  252.  
  253. #
  254. # default: all messages (local syslog + kernel)
  255. #
  256. # should be at the end so that application specific messages with
  257. # "final" flag are not logged
  258. #
  259.  
  260. destination d_messages { file("/var/log/messages" template(t_local)); };
  261. log { source(s_local); source(s_kernel); destination(d_messages); };