Softpanorama

May the source be with you, but remember the KISS principle ;-)
Home Switchboard Unix Administration Red Hat TCP/IP Networks Neoliberalism Toxic Managers
(slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and  bastardization of classic Unix

Syslog-ng.conf Examples

News See also Recommended Links Manual Reference Recommended Papers Installation on Solaris 9
Options Configuring syslog-ng to send logs Filters Configuration Examples Tips History Humor

Introduction

A key aspect of management of network servers and devices is regular review of log messages. Log messages can also be used forensically to troubleshoot network problems. On many types of systems including Linux and UNIX servers and various other networking devices like switches and routers, system message logging follows a standardized format known as syslog messages. One way to improve IT management and administration is to centralize syslog messages from all the diverse devices on a corporate network onto a single syslog server or loghost. Centralization allows the use of automated log analysis tools to alert and search for specific message types, improving the tools available to system administrators to manage networks.

Syslog-NG has sophisticated filtering mechanisms which allow different system messages for a given host to be routed to different files or logging mechanisms depending on type or severity. For example, messages with a low severity could be logged to file, while messages with higher severity could be logged to file and emailed to the sysadmin's mobile phone for immediate action. On SLED 10, Syslog-NG is the default system logger.

Configuring Loghost to Receive Log Messages

By default Syslog-NG is configured only to log messages from the host it is running on. If you want a centralized loghost, you must enable Syslog-NG to receive log messages from over the network.   See

You have to edit /etc/syslog-ng/syslog-ng.in and add some settings. The file is divided into sections called source, destination, filter and log.

Structure of syslog-ng configuration file

Syslog-ng configuration file is based on idea of separation of "filters" used to select messages from the messages stream and targets.

  1. Filters are defines with filter statements, in which you define label and content of partifcular filte. After that the filter can be referenced by ifs label, For example let's define label  f_cron to be filter that select cron messages:
    filter f_cron { facility(cron); };
  2. Targers are defined with destination statement. For example: 
    destination cron { file("/var/log/cron.log"); };
After that you can match filter and target to create log statement which corresponds to the rule of classic syslog, with the difference that you operate using labels not actually definitions: 
log { source(src); filter(f_authpriv); destination(authlog); };
One additional feature that you also define source of log messages in the log statement. But for most such statement the source is syslog stream: 
source src { unix-stream("/dev/log"); internal(); };

Examples

syslog-ng examples

Options and source 
options { long_hostnames(off); sync(0); };

source src { unix-stream("/dev/log"); internal(); };
source kernsrc { file("/proc/kmsg"); };
2. Destination 
destination authlog { file("/var/log/auth.log"); };
destination syslog { file("/var/log/syslog"); };
destination cron { file("/var/log/cron.log"); };
destination daemon { file("/var/log/daemon.log"); };
destination kern { file("/var/log/kern.log"); };
destination lpr { file("/var/log/lpr.log"); };
destination user { file("/var/log/user.log"); };
destination uucp { file("/var/log/uucp.log"); };
destination ppp { file("/var/log/ppp.log"); };
destination mail { file("/var/log/mail.log"); };

destination mailinfo { file("/var/log/mail.info"); };
destination mailwarn { file("/var/log/mail.warn"); };
destination mailerr { file("/var/log/mail.err"); };
destination local0 { file("/var/log/local0.log"); };
destination local1 { file("/var/log/local1.log"); };
destination all { file("/var/log/all.log"); };

destination newscrit { file("/var/log/news/news.crit"); };
destination newserr { file("/var/log/news/news.err"); };
destination newsnotice { file("/var/log/news/news.notice"); };

destination debug { file("/var/log/debug"); };
destination messages { file("/var/log/messages"); };
destination console { usertty("root"); };
destination console_all { file("/dev/tty12"); };
3.Filters 
filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
filter f_syslog { not facility(authpriv, mail) and not match(ppp.*LCP); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail) and not match (imapd); };
filter f_user { facility(user); };
filter f_uucp { facility(cron); };
filter f_ppp { program(ppp); };
filter f_news { facility(news); };
filter f_debug { not facility(auth, authpriv, news, mail) and not match(ppp.*LCP); };
filter f_messages { level(info..warn) 
	and not facility(auth, authpriv, mail, news); };
filter f_emergency { level(emerg); };

filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };
4. Output 
log { source(src); filter(f_authpriv); destination(authlog); };
log { source(src); filter(f_syslog); destination(syslog); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_daemon); destination(daemon); };
log { source(kernsrc); filter(f_kern); destination(kern); };
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_user); destination(user); };
log { source(src); filter(f_uucp); destination(uucp); };
log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };
log { source(src); filter(f_news); filter(f_crit); destination(newscrit); };
log { source(src); filter(f_news); filter(f_err); destination(newserr); };
log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); };
log { source(src); filter(f_debug); destination(debug); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };
log { source(src); filter(f_ppp); destination(ppp); };
log { source(src); destination(console_all); };
log { source(src); destination(all); };

I've setup syslog-ng to archive logs to host-specific directories in /var/log/HOSTS on my central loghost. This way standard UNIX tools like find and grep can be used for log parsing and do it either by time or by host. To grep against the log files for all hosts on November 8th, 2001 I can do this: 

 $  grep hacker /var/log/HOSTS/*/2001/11/08/*

...and I can just traverse all logs for a host using find or 'grep -r' since all logs for one host are in a single directory structure.

Here's the syslog-ng.conf directives to archive the way I've done it: 

  destination hosts { 
   file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY"
   owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); 
  };
  
  log {
	source(src);
	destination(hosts);
  };

With this you can match message content (in this case the string "attackalert") and mail them. In syslog-ng.conf: 

  destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); };
  
  filter f_attack_alert {
		match("attackalert"); 
  };
  
  # find messages with "attackalert" in them, and send to the mail-alert script
  log {
	source(src);
	filter(f_attack_alert);
	destination(mail-alert-perl);
   };

Use this perl script to strip off the message priority (which I've found to be useless and just clutters up the message) and mail it:

Check out a sample syslog-ng.conf file Warning:

Before you put in place automatic email alerts - ask yourself if it's possible to generate hundreds or even thousands of those log messages. What would happen to your mail server? Would you even see any other alerts if you're deleting hundreds or thousands of one message?

Put in place some throtting before you setup auto-emailing (you can use the "bash-mail-alert" script from the swatch section). This is a great area for DoS, so watch yourself.

configure syslog-ng

options { long_hostnames (off);
          sync (0);
          log_fifo_size(10);
          owner(root);
          group(sys);
          perm(0644);
        };

source local { sun-streams("/dev/log" door("/etc/.syslog_door"));
               internal(); 
             };

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/adm/messages" perm(0600)); };
destination d_auth { file("/var/log/authlog"); };
destination d_mail { file("/var/log/maillog"); };
destination d_news { file("/var/log/newslog"); };
destination d_daem { file("/var/log/daemonlog"); };
destination d_ipf  { file("/var/log/ipf.log"); };
destination d_mlop { usertty("operator"); };
destination d_mlrt { usertty("root"); };
destination d_mlal { usertty("*"); };

filter f_filter1   { level(err) or
                     (level(notice) and facility (auth, kern)); };
filter f_filter2   { level(err) or
                     (facility(kern) and level(notice)) or
                     (facility(daemon) and level(notice)) or
                     (facility(mail) and level(crit)); };
filter f_filter3   { level(alert) or
                     (facility(kern) and level(err)) or
                     (facility(daemon) and level(err)); };
filter f_filter4   { level(alert); };
filter f_filter5   { level(emerg); };
filter f_filter6   { facility(user) and level(err); };
filter f_filter7   { facility(user) and level(alert); };
filter f_filter8   { facility(kern) and level(notice); };

filter f_mail { facility(mail); };
filter f_news { facility(news); };
filter f_auth { facility(auth); };
filter f_daem { facility(daemon) and 
level(info,warn,notice,err,crit,alert,emerg); };
filter f_ipf  { facility(local0); };

filter f_debug     { not facility(auth, news, mail, local0); };
filter f_emergency { level(emerg); };
filter f_info      { level(info); };
filter f_notice    { level(notice); };
filter f_warn      { level(warn); };
filter f_crit      { level(crit); };
filter f_err       { level(err); };

log { source(local); filter(f_filter1); destination(d_cons); };
log { source(local); filter(f_filter2); destination(d_mesg); };
log { source(local); filter(f_filter3); destination(d_mlop); };
log { source(local); filter(f_filter4); destination(d_mlrt); };
log { source(local); filter(f_filter5); destination(d_mlal); };
log { source(local); filter(f_filter6); destination(d_cons);
                                        destination(d_mesg); };
log { source(local); filter(f_filter7); destination(d_mlop);
                                        destination(d_mlrt); };
log { source(local); filter(f_filter8); destination(d_auth); };

log { source(local); filter(f_auth); destination(d_auth); };
log { source(local); filter(f_daem); destination(d_daem); };
log { source(local); filter(f_mail); destination(d_mail); };
log { source(local); filter(f_news); destination(d_news); };
log { source(local); filter(f_ipf); destination(d_ipf); };

BigAdmin Feature Article Creating a Centralized Secure Log Server with syslog-ng and Stunnel

# Options
options {
          use_fqdn(yes);
          sync(0);
          keep_hostname(yes);
          chain_hostnames(no);
	  create_dirs(yes);
        };

# Sources of syslog messages (both local and remote messages on the server)
source s_local   { 
                   sun-streams("/dev/log" door("/etc/.syslog_door")); 
                   internal();
                 };
source s_stunnel { 
                   tcp(ip("127.0.0.1")
                   port(514)
                   max-connections(1));
                 };

source s_udp     { udp(); };

# Level Filters
filter f_emerg   { level (emerg);            };
filter f_alert   { level (alert .. emerg);   };
filter f_crit    { level (crit .. emerg);    };
filter f_err     { level (err .. emerg);     };
filter f_warning { level (warning .. emerg); };
filter f_notice  { level (notice .. emerg);  };
filter f_info    { level (info .. emerg);    };
filter f_debug   { level (debug .. emerg);   };

# Facility Filters
filter f_kern   { facility (kern);   };
filter f_user   { facility (user);   };
filter f_mail   { facility (mail);   };
filter f_daemon { facility (daemon); };
filter f_auth   { facility (auth);   };
filter f_syslog { facility (syslog); };
filter f_lpr    { facility (lpr);    };
filter f_news   { facility (news);   };
filter f_uucp   { facility (uucp);   };
filter f_cron   { facility (cron);   };
filter f_local0 { facility (local0); };
filter f_local1 { facility (local1); };
filter f_local2 { facility (local2); };
filter f_local3 { facility (local3); };
filter f_local4 { facility (local4); };
filter f_local5 { facility (local5); };
filter f_local6 { facility (local6); };
filter f_local7 { facility (local7); };

# Custom Filters
filter f_user_none     { not facility (user);                     };
filter f_kern_debug    { filter (f_kern) and filter (f_debug);    };
filter f_daemon_notice { filter (f_daemon) and filter (f_notice); };
filter f_mail_crit     { filter (f_mail) and filter (f_crit);     };
filter f_mesg          { filter (f_kern_debug) or 
                         filter (f_daemon_notice) or 
                         filter (f_mail_crit);                    };
filter f_authinfo      { filter (f_auth) or program (sudo);       };

# Destinations: local files, the console, and the client files
destination l_authlog  { file ("/var/log/authlog");   };
destination l_messages { file ("/var/log/messages");  };
destination l_maillog  { file ("/var/log/maillog");   };
destination l_ipflog   { file ("/var/log/ipflog");    };
destination l_imaplog  { file ("/var/log/imaplog");   };
destination l_syslog   { file ("/var/log/syslog");    };

destination l_console  { file ("/dev/console");       };

destination r_authlog  { file
  ("/var/log/clients/$YEAR/$MONTH/$HOST/authlog");    }; 
destination r_messages { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/messages");   }; 
destination r_maillog  { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/maillog");    }; 
destination r_ipflog   { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/ipflog");     }; 
destination r_imaplog  { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/imaplog");    }; 
destination r_console  { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/consolelog"); }; 
destination r_syslog   { file
  ("/var/log/clients/$YEAR/$MONTH/$HOST/syslog");     };
destination r_fallback { file
  ("/var/log/clients/$YEAR/$MONTH/$HOST/$FACILITY-$LEVEL"); };

# Log statements
# Local sources
log { source (s_local); filter (f_authinfo)  destination (l_authlog);  };
log { source (s_local); filter (f_mail);     destination (l_maillog);  };
log { source (s_local); filter (f_local0);   destination (l_ipflog);   };
log { source (s_local); filter (f_local1);   destination (l_imaplog);  };
log { source (s_local); filter (f_syslog);   destination (l_syslog);   };
log { source (s_local); filter (f_emerg); filter (f_user_none); 
                                             destination (l_console);  };
log { source (s_local); filter (f_mesg);  filter (f_user_none);
                                             destination (l_messages); }; 

# All sources, since we want to archive local and remote logs
log { source (s_local); source (s_stunnel); filter (f_authinfo);
     destination (r_authlog);   };
log { source (s_local); source (s_stunnel); filter (f_mail);
     destination (r_maillog);   };
log { source (s_local); source (s_stunnel); filter (f_local0);
   destination (r_ipflog);      };
log { source (s_local); source (s_stunnel); filter (f_local1);
   destination (r_imaplog);     };
log { source (s_local); source (s_stunnel); filter (f_syslog);
   destination (r_syslog);      };
log { source (s_local); source (s_stunnel); filter (f_emerg); 
      filter (f_user_none);
      destination (l_console);  };
log { source (s_local); source (s_stunnel); filter (f_mesg);
   filter (f_user_none);
      destination (l_messages); };

In this example client syslog-ng.conf, the filters remain the same, but most other parts of the configuration either change to reflect the client status or are removed:

# Options
options { 
          sync(0);
          use_fqdn(yes);
        };

# Sources of syslog messages (only local on clients)
source s_local { 
                 sun-streams("/dev/log" door("/etc/.syslog_door")); 
                 internal();
               };

# Destinations: local files, the console, and the remote syslog server
destination l_authlog  { file ("/var/log/authlog");   };
destination l_messages { file ("/var/log/messages");  };
destination l_maillog  { file ("/var/log/maillog");   };
destination l_ipflog   { file ("/var/log/ipflog");    };
destination l_imaplog  { file ("/var/log/imaplog");   };
destination l_console  { file ("/dev/console");       };
destination l_syslog   { file ("/var/log/syslog");    };
destination stunnel    { tcp ("127.0.0.1", port(514)); };

# Level Filters
filter f_emerg   { level (emerg);            };
filter f_alert   { level (alert .. emerg);   };
filter f_crit    { level (crit .. emerg);    };
filter f_err     { level (err .. emerg);     };
filter f_warning { level (warning .. emerg); };
filter f_notice  { level (notice .. emerg);  };
filter f_info    { level (info .. emerg);    };
filter f_debug   { level (debug .. emerg);   };

# Facility Filters
filter f_kern   { facility (kern);   };
filter f_user   { facility (user);   };
filter f_mail   { facility (mail);   };
filter f_daemon { facility (daemon); };
filter f_auth   { facility (auth);   };
filter f_syslog { facility (syslog); };
filter f_lpr    { facility (lpr);    };
filter f_news   { facility (news);   };
filter f_uucp   { facility (uucp);   };
filter f_cron   { facility (cron);   };
filter f_local0 { facility (local0); };
filter f_local1 { facility (local1); };
filter f_local2 { facility (local2); };
filter f_local3 { facility (local3); };
filter f_local4 { facility (local4); };
filter f_local5 { facility (local5); };
filter f_local6 { facility (local6); };
filter f_local7 { facility (local7); }; 

# Custom Filters
filter f_user_none     { not facility (user);                     };
filter f_kern_debug    { filter (f_kern) and filter (f_debug);    };
filter f_daemon_notice { filter (f_daemon) and filter (f_notice); };
filter f_mail_crit     { filter (f_mail) and filter (f_crit);     };
filter f_mesg          { filter (f_kern_debug) or 
                         filter (f_daemon_notice) or 
                         filter (f_mail_crit);                    };
filter f_authinfo      { filter (f_auth) or program (sudo);       };

# Log statements
# Log things locally
log { source (s_local); filter (f_authinfo); destination (l_authlog);  };
log { source (s_local); filter (f_mail);     destination (l_maillog);  };
log { source (s_local); filter (f_local0);   destination (l_ipflog);   };
log { source (s_local); filter (f_local1);   destination (l_imaplog);  };
log { source (s_local); filter (f_syslog);   destination (l_syslog);   };
log { source (s_local); filter (f_emerg); filter (f_user_none); 
                                             destination (l_console);  };
log { source (s_local); filter (f_mesg); filter (f_user_none);
                                             destination (l_messages); }; 

# Log everything remotely via stunnel
log { source (s_local);                      destination (stunnel);    };

 

Top updates
Bulletin Latest Past week Past month
Google Search

NEWS CONTENTS

Old News ;-)

syslog-ng examples

Options and source 
options { long_hostnames(off); sync(0); };

source src { unix-stream("/dev/log"); internal(); };
source kernsrc { file("/proc/kmsg"); };
2. Destination 
destination authlog { file("/var/log/auth.log"); };
destination syslog { file("/var/log/syslog"); };
destination cron { file("/var/log/cron.log"); };
destination daemon { file("/var/log/daemon.log"); };
destination kern { file("/var/log/kern.log"); };
destination lpr { file("/var/log/lpr.log"); };
destination user { file("/var/log/user.log"); };
destination uucp { file("/var/log/uucp.log"); };
destination ppp { file("/var/log/ppp.log"); };
destination mail { file("/var/log/mail.log"); };

destination mailinfo { file("/var/log/mail.info"); };
destination mailwarn { file("/var/log/mail.warn"); };
destination mailerr { file("/var/log/mail.err"); };
destination local0 { file("/var/log/local0.log"); };
destination local1 { file("/var/log/local1.log"); };
destination all { file("/var/log/all.log"); };

destination newscrit { file("/var/log/news/news.crit"); };
destination newserr { file("/var/log/news/news.err"); };
destination newsnotice { file("/var/log/news/news.notice"); };

destination debug { file("/var/log/debug"); };
destination messages { file("/var/log/messages"); };
destination console { usertty("root"); };
destination console_all { file("/dev/tty12"); };
3.Filters 
filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
filter f_syslog { not facility(authpriv, mail) and not match(ppp.*LCP); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail) and not match (imapd); };
filter f_user { facility(user); };
filter f_uucp { facility(cron); };
filter f_ppp { program(ppp); };
filter f_news { facility(news); };
filter f_debug { not facility(auth, authpriv, news, mail) and not match(ppp.*LCP); };
filter f_messages { level(info..warn) 
	and not facility(auth, authpriv, mail, news); };
filter f_emergency { level(emerg); };

filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };
4. Output 
log { source(src); filter(f_authpriv); destination(authlog); };
log { source(src); filter(f_syslog); destination(syslog); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_daemon); destination(daemon); };
log { source(kernsrc); filter(f_kern); destination(kern); };
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_user); destination(user); };
log { source(src); filter(f_uucp); destination(uucp); };
log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };
log { source(src); filter(f_news); filter(f_crit); destination(newscrit); };
log { source(src); filter(f_news); filter(f_err); destination(newserr); };
log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); };
log { source(src); filter(f_debug); destination(debug); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };
log { source(src); filter(f_ppp); destination(ppp); };
log { source(src); destination(console_all); };
log { source(src); destination(all); };

I've setup syslog-ng to archive logs to host-specific directories in /var/log/HOSTS on my central loghost. This way standard UNIX tools like find and grep can be used for log parsing and do it either by time or by host. To grep against the log files for all hosts on November 8th, 2001 I can do this: 

 $  grep hacker /var/log/HOSTS/*/2001/11/08/*

...and I can just traverse all logs for a host using find or 'grep -r' since all logs for one host are in a single directory structure.

Here's the syslog-ng.conf directives to archive the way I've done it: 

  destination hosts { 
   file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY"
   owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); 
  };
  
  log {
	source(src);
	destination(hosts);
  };

With this you can match message content (in this case the string "attackalert") and mail them. In syslog-ng.conf: 

  destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); };
  
  filter f_attack_alert {
		match("attackalert"); 
  };
  
  # find messages with "attackalert" in them, and send to the mail-alert script
  log {
	source(src);
	filter(f_attack_alert);
	destination(mail-alert-perl);
   };

Use this perl script to strip off the message priority (which I've found to be useless and just clutters up the message) and mail it:

Check out a sample syslog-ng.conf file Warning:

Before you put in place automatic email alerts - ask yourself if it's possible to generate hundreds or even thousands of those log messages. What would happen to your mail server? Would you even see any other alerts if you're deleting hundreds or thousands of one message?

Put in place some throtting before you setup auto-emailing (you can use the "bash-mail-alert" script from the swatch section). This is a great area for DoS, so watch yourself.

configure syslog-ng

options { long_hostnames (off);
          sync (0);
          log_fifo_size(10);
          owner(root);
          group(sys);
          perm(0644);
        };

source local { sun-streams("/dev/log" door("/etc/.syslog_door"));
               internal(); 
             };

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/adm/messages" perm(0600)); };
destination d_auth { file("/var/log/authlog"); };
destination d_mail { file("/var/log/maillog"); };
destination d_news { file("/var/log/newslog"); };
destination d_daem { file("/var/log/daemonlog"); };
destination d_ipf  { file("/var/log/ipf.log"); };
destination d_mlop { usertty("operator"); };
destination d_mlrt { usertty("root"); };
destination d_mlal { usertty("*"); };

filter f_filter1   { level(err) or
                     (level(notice) and facility (auth, kern)); };
filter f_filter2   { level(err) or
                     (facility(kern) and level(notice)) or
                     (facility(daemon) and level(notice)) or
                     (facility(mail) and level(crit)); };
filter f_filter3   { level(alert) or
                     (facility(kern) and level(err)) or
                     (facility(daemon) and level(err)); };
filter f_filter4   { level(alert); };
filter f_filter5   { level(emerg); };
filter f_filter6   { facility(user) and level(err); };
filter f_filter7   { facility(user) and level(alert); };
filter f_filter8   { facility(kern) and level(notice); };

filter f_mail { facility(mail); };
filter f_news { facility(news); };
filter f_auth { facility(auth); };
filter f_daem { facility(daemon) and 
level(info,warn,notice,err,crit,alert,emerg); };
filter f_ipf  { facility(local0); };

filter f_debug     { not facility(auth, news, mail, local0); };
filter f_emergency { level(emerg); };
filter f_info      { level(info); };
filter f_notice    { level(notice); };
filter f_warn      { level(warn); };
filter f_crit      { level(crit); };
filter f_err       { level(err); };

log { source(local); filter(f_filter1); destination(d_cons); };
log { source(local); filter(f_filter2); destination(d_mesg); };
log { source(local); filter(f_filter3); destination(d_mlop); };
log { source(local); filter(f_filter4); destination(d_mlrt); };
log { source(local); filter(f_filter5); destination(d_mlal); };
log { source(local); filter(f_filter6); destination(d_cons);
                                        destination(d_mesg); };
log { source(local); filter(f_filter7); destination(d_mlop);
                                        destination(d_mlrt); };
log { source(local); filter(f_filter8); destination(d_auth); };

log { source(local); filter(f_auth); destination(d_auth); };
log { source(local); filter(f_daem); destination(d_daem); };
log { source(local); filter(f_mail); destination(d_mail); };
log { source(local); filter(f_news); destination(d_news); };
log { source(local); filter(f_ipf); destination(d_ipf); };

BigAdmin Feature Article Creating a Centralized Secure Log Server with syslog-ng and Stunnel

# Options
options {
          use_fqdn(yes);
          sync(0);
          keep_hostname(yes);
          chain_hostnames(no);
	  create_dirs(yes);
        };

# Sources of syslog messages (both local and remote messages on the server)
source s_local   { 
                   sun-streams("/dev/log" door("/etc/.syslog_door")); 
                   internal();
                 };
source s_stunnel { 
                   tcp(ip("127.0.0.1")
                   port(514)
                   max-connections(1));
                 };

source s_udp     { udp(); };

# Level Filters
filter f_emerg   { level (emerg);            };
filter f_alert   { level (alert .. emerg);   };
filter f_crit    { level (crit .. emerg);    };
filter f_err     { level (err .. emerg);     };
filter f_warning { level (warning .. emerg); };
filter f_notice  { level (notice .. emerg);  };
filter f_info    { level (info .. emerg);    };
filter f_debug   { level (debug .. emerg);   };

# Facility Filters
filter f_kern   { facility (kern);   };
filter f_user   { facility (user);   };
filter f_mail   { facility (mail);   };
filter f_daemon { facility (daemon); };
filter f_auth   { facility (auth);   };
filter f_syslog { facility (syslog); };
filter f_lpr    { facility (lpr);    };
filter f_news   { facility (news);   };
filter f_uucp   { facility (uucp);   };
filter f_cron   { facility (cron);   };
filter f_local0 { facility (local0); };
filter f_local1 { facility (local1); };
filter f_local2 { facility (local2); };
filter f_local3 { facility (local3); };
filter f_local4 { facility (local4); };
filter f_local5 { facility (local5); };
filter f_local6 { facility (local6); };
filter f_local7 { facility (local7); };

# Custom Filters
filter f_user_none     { not facility (user);                     };
filter f_kern_debug    { filter (f_kern) and filter (f_debug);    };
filter f_daemon_notice { filter (f_daemon) and filter (f_notice); };
filter f_mail_crit     { filter (f_mail) and filter (f_crit);     };
filter f_mesg          { filter (f_kern_debug) or 
                         filter (f_daemon_notice) or 
                         filter (f_mail_crit);                    };
filter f_authinfo      { filter (f_auth) or program (sudo);       };

# Destinations: local files, the console, and the client files
destination l_authlog  { file ("/var/log/authlog");   };
destination l_messages { file ("/var/log/messages");  };
destination l_maillog  { file ("/var/log/maillog");   };
destination l_ipflog   { file ("/var/log/ipflog");    };
destination l_imaplog  { file ("/var/log/imaplog");   };
destination l_syslog   { file ("/var/log/syslog");    };

destination l_console  { file ("/dev/console");       };

destination r_authlog  { file
  ("/var/log/clients/$YEAR/$MONTH/$HOST/authlog");    }; 
destination r_messages { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/messages");   }; 
destination r_maillog  { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/maillog");    }; 
destination r_ipflog   { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/ipflog");     }; 
destination r_imaplog  { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/imaplog");    }; 
destination r_console  { file 
  ("/var/log/clients/$YEAR/$MONTH/$HOST/consolelog"); }; 
destination r_syslog   { file
  ("/var/log/clients/$YEAR/$MONTH/$HOST/syslog");     };
destination r_fallback { file
  ("/var/log/clients/$YEAR/$MONTH/$HOST/$FACILITY-$LEVEL"); };

# Log statements
# Local sources
log { source (s_local); filter (f_authinfo)  destination (l_authlog);  };
log { source (s_local); filter (f_mail);     destination (l_maillog);  };
log { source (s_local); filter (f_local0);   destination (l_ipflog);   };
log { source (s_local); filter (f_local1);   destination (l_imaplog);  };
log { source (s_local); filter (f_syslog);   destination (l_syslog);   };
log { source (s_local); filter (f_emerg); filter (f_user_none); 
                                             destination (l_console);  };
log { source (s_local); filter (f_mesg);  filter (f_user_none);
                                             destination (l_messages); }; 

# All sources, since we want to archive local and remote logs
log { source (s_local); source (s_stunnel); filter (f_authinfo);
     destination (r_authlog);   };
log { source (s_local); source (s_stunnel); filter (f_mail);
     destination (r_maillog);   };
log { source (s_local); source (s_stunnel); filter (f_local0);
   destination (r_ipflog);      };
log { source (s_local); source (s_stunnel); filter (f_local1);
   destination (r_imaplog);     };
log { source (s_local); source (s_stunnel); filter (f_syslog);
   destination (r_syslog);      };
log { source (s_local); source (s_stunnel); filter (f_emerg); 
      filter (f_user_none);
      destination (l_console);  };
log { source (s_local); source (s_stunnel); filter (f_mesg);
   filter (f_user_none);
      destination (l_messages); };

In this example client syslog-ng.conf, the filters remain the same, but most other parts of the configuration either change to reflect the client status or are removed:

# Options
options { 
          sync(0);
          use_fqdn(yes);
        };

# Sources of syslog messages (only local on clients)
source s_local { 
                 sun-streams("/dev/log" door("/etc/.syslog_door")); 
                 internal();
               };

# Destinations: local files, the console, and the remote syslog server
destination l_authlog  { file ("/var/log/authlog");   };
destination l_messages { file ("/var/log/messages");  };
destination l_maillog  { file ("/var/log/maillog");   };
destination l_ipflog   { file ("/var/log/ipflog");    };
destination l_imaplog  { file ("/var/log/imaplog");   };
destination l_console  { file ("/dev/console");       };
destination l_syslog   { file ("/var/log/syslog");    };
destination stunnel    { tcp ("127.0.0.1", port(514)); };

# Level Filters
filter f_emerg   { level (emerg);            };
filter f_alert   { level (alert .. emerg);   };
filter f_crit    { level (crit .. emerg);    };
filter f_err     { level (err .. emerg);     };
filter f_warning { level (warning .. emerg); };
filter f_notice  { level (notice .. emerg);  };
filter f_info    { level (info .. emerg);    };
filter f_debug   { level (debug .. emerg);   };

# Facility Filters
filter f_kern   { facility (kern);   };
filter f_user   { facility (user);   };
filter f_mail   { facility (mail);   };
filter f_daemon { facility (daemon); };
filter f_auth   { facility (auth);   };
filter f_syslog { facility (syslog); };
filter f_lpr    { facility (lpr);    };
filter f_news   { facility (news);   };
filter f_uucp   { facility (uucp);   };
filter f_cron   { facility (cron);   };
filter f_local0 { facility (local0); };
filter f_local1 { facility (local1); };
filter f_local2 { facility (local2); };
filter f_local3 { facility (local3); };
filter f_local4 { facility (local4); };
filter f_local5 { facility (local5); };
filter f_local6 { facility (local6); };
filter f_local7 { facility (local7); }; 

# Custom Filters
filter f_user_none     { not facility (user);                     };
filter f_kern_debug    { filter (f_kern) and filter (f_debug);    };
filter f_daemon_notice { filter (f_daemon) and filter (f_notice); };
filter f_mail_crit     { filter (f_mail) and filter (f_crit);     };
filter f_mesg          { filter (f_kern_debug) or 
                         filter (f_daemon_notice) or 
                         filter (f_mail_crit);                    };
filter f_authinfo      { filter (f_auth) or program (sudo);       };

# Log statements
# Log things locally
log { source (s_local); filter (f_authinfo); destination (l_authlog);  };
log { source (s_local); filter (f_mail);     destination (l_maillog);  };
log { source (s_local); filter (f_local0);   destination (l_ipflog);   };
log { source (s_local); filter (f_local1);   destination (l_imaplog);  };
log { source (s_local); filter (f_syslog);   destination (l_syslog);   };
log { source (s_local); filter (f_emerg); filter (f_user_none); 
                                             destination (l_console);  };
log { source (s_local); filter (f_mesg); filter (f_user_none);
                                             destination (l_messages); }; 

# Log everything remotely via stunnel
log { source (s_local);                      destination (stunnel);    };

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

 You can use PayPal to to buy a cup of coffee for authors of this site

Disclaimer:

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: July 28, 2019