-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsyslog-ng.conf
117 lines (109 loc) · 5.19 KB
/
syslog-ng.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
@version: 3.15
@include "scl.conf"
#
# /etc/syslog-ng/syslog-ng.conf
#
options {
stats_freq (0);
flush_lines (0);
time_reopen (10);
log_fifo_size (10000);
chain_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
perm(0640);
group("log");
};
source src {
system();
internal();
};
destination d_authlog { file("/var/log/auth.log"); };
destination d_ldap { file("/var/log/ldap.log"); };
destination d_syslog { file("/var/log/syslog.log"); };
destination d_cron { file("/var/log/crond.log"); };
destination d_daemon { file("/var/log/daemon.log"); };
destination d_kernel { file("/var/log/kernel.log"); };
destination d_lpr { file("/var/log/lpr.log"); };
destination d_user { file("/var/log/user.log"); };
destination d_uucp { file("/var/log/uucp.log"); };
destination d_mail { file("/var/log/mail.log"); };
destination d_news { file("/var/log/news.log"); };
destination d_ppp { file("/var/log/ppp.log"); };
destination d_debug { file("/var/log/debug.log"); };
destination d_messages { file("/var/log/messages.log"); };
destination d_errors { file("/var/log/errors.log"); };
destination d_everything { file("/var/log/everything.log"); };
destination d_iptables { file("/var/log/iptables.log"); };
destination d_acpid { file("/var/log/acpid.log"); };
destination d_console { usertty("root"); };
destination d_ssh { file("/var/log/ssh.log"); };
destination d_vpn { file("/var/log/vpn.log"); };
destination d_noise { file("/var/log/noise.log"); };
destination d_nginx { file("/var/log/nginx.log"); };
destination d_systemd { file("/var/log/systemd.log"); };
destination d_monitoring { file("/var/log/monitoring.log"); };
# Log everything to tty12
destination console_all { file("/dev/tty12"); };
filter f_acpid { program("acpid"); };
filter f_ssh { program("sshd") or program("sshguard"); };
filter f_vpn { program("openvpn"); };
filter f_nginx { program("nginx"); };
filter f_iptables { match("IN=" value("MESSAGE")) and match("OUT=" value("MESSAGE")); };
filter f_mailapp { program("exim") or program("mailman") or program("mailmanctl") or program("spamd") or program("dovecot"); };
filter f_monitoring { program("grafana-server") or program("grafana") or program("prometheus") or program("elasticsearch")};
filter f_auth { facility(auth) and not filter(f_ssh) and not filter(f_mailapp); };
filter f_authpriv { facility(auth, authpriv) and not filter(f_ssh) and not filter(f_mailapp); };
filter f_ldap { program("slapd"); };
filter f_syslog { program("syslog-ng"); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kernel { facility(kern) and not filter(f_iptables); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail) or filter(f_mailapp); };
filter f_news { facility(news); };
filter f_user { facility(user); };
filter f_uucp { facility(uucp); };
filter f_ppp { facility(local2); };
filter f_debug { not facility(auth, authpriv, news, mail) and not filter(f_ssh); };
filter f_noise { filter(f_kernel) or filter(f_ssh) or filter(f_iptables) or filter(f_vpn) or filter(f_syslog) or facility(auth, authpriv) or filter(f_mail) or filter(f_nginx) or filter(f_ldap) or filter(f_monitoring); };
filter f_messages { level(info..warn) and facility(news, cron) and not filter(f_noise); };
filter f_everything_disk { level(debug..emerg) and not filter(f_noise); };
filter f_emergency { level(emerg); };
filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err) and not filter(f_noise); };
filter f_everything { level(debug..emerg); };
filter f_systemd { program("systemd"); };
log { source(src); filter(f_acpid); destination(d_acpid); };
log { source(src); filter(f_authpriv); destination(d_authlog); };
log { source(src); filter(f_syslog); destination(d_syslog); };
log { source(src); filter(f_cron); destination(d_cron); };
log { source(src); filter(f_daemon); destination(d_daemon); };
log { source(src); filter(f_kernel); destination(d_kernel); };
log { source(src); filter(f_lpr); destination(d_lpr); };
log { source(src); filter(f_mail); destination(d_mail); };
log { source(src); filter(f_news); destination(d_news); };
log { source(src); filter(f_ppp); destination(d_ppp); };
log { source(src); filter(f_user); destination(d_user); };
log { source(src); filter(f_uucp); destination(d_uucp); };
#log { source(src); filter(f_debug); destination(d_debug); };
log { source(src); filter(f_messages); destination(d_messages); };
log { source(src); filter(f_err); destination(d_errors); };
log { source(src); filter(f_emergency); destination(d_console); };
log { source(src); filter(f_everything_disk); destination(d_everything); };
log { source(src); filter(f_iptables); destination(d_iptables); };
log { source(src); filter(f_ssh); destination(d_ssh); };
log { source(src); filter(f_vpn); destination(d_vpn); };
log { source(src); filter(f_nginx); destination(d_nginx); };
log { source(src); filter(f_ldap); destination(d_ldap); };
log { source(src); filter(f_systemd); destination(d_systemd); };
log { source(src); filter(f_monitoring); destination(d_monitoring); };
# Log everything to tty12
#log { source(src); destination(console_all); };
@include "syslog-ng-recv.conf"
@include "syslog-ng-send.conf"