106 lines
3.9 KiB
Django/Jinja
106 lines
3.9 KiB
Django/Jinja
@version:3.30
|
|
@include "scl.conf"
|
|
|
|
# syslog-ng configuration file.
|
|
#
|
|
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
|
|
#
|
|
# Note: It also sources additional configuration files (*.conf)
|
|
# located in /etc/syslog-ng/conf.d/.
|
|
|
|
#
|
|
# Options
|
|
#
|
|
options {
|
|
# Create destination directories if missing.
|
|
create_dirs(yes);
|
|
|
|
# The default action of syslog-ng is to log a MARK line to the file every
|
|
# 20 minutes. That's seems high for most people so turn it down to once an
|
|
# hour. Set it to zero if you don't want the functionality at all.
|
|
mark_freq(3600);
|
|
|
|
# The default action of syslog-ng is to log a STATS line to the file every
|
|
# 10 minutes. That's pretty ugly after a while. Change it to every 12 hours
|
|
# so you get a nice daily update of how many messages syslog-ng missed (0).
|
|
stats_freq(43200);
|
|
|
|
# Time to wait before a died connection is re-established (default is 60).
|
|
time_reopen(5);
|
|
|
|
# Disable DNS usage.
|
|
# syslog-ng blocks on DNS queries, so enabling DNS may lead to a DoS attack.
|
|
use_dns(no);
|
|
dns-cache(no);
|
|
|
|
# Default owner, group, and permissions for log files.
|
|
owner(root);
|
|
group(adm);
|
|
perm(0640);
|
|
|
|
# Default permissions for created directories.
|
|
dir_perm(0755);
|
|
};
|
|
|
|
source src { system(); internal(); };
|
|
|
|
filter f_auth { facility(auth, authpriv); };
|
|
filter f_syslog { not facility(authpriv, mail) and not message("^grsec:( From [^:]+:)? exec of.*") and not (program("named") and message("^client ")); };
|
|
filter f_cron { facility(cron); };
|
|
filter f_daemon { facility(daemon); };
|
|
filter f_kern { facility(kern); };
|
|
filter f_mail { facility(mail, news); };
|
|
filter f_user { facility(user); };
|
|
filter f_debug { not facility(auth, authpriv, news, mail); };
|
|
filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news) and not message("^grsec:( From [^:]+:)? exec of.*"); };
|
|
filter f_emergency { level(emerg); };
|
|
|
|
filter f_info { level(info); };
|
|
|
|
filter f_notice { level(notice); };
|
|
filter f_warn { level(warn); };
|
|
filter f_crit { level(crit); };
|
|
filter f_err { level(err); };
|
|
|
|
filter f_audit { message("^audit.*"); };
|
|
filter f_history { message(".*HISTORY*"); };
|
|
|
|
filter f_sshguard { facility(auth, authpriv) and not program("sshguard"); };
|
|
|
|
destination authlog { file("/var/log/auth.log"); };
|
|
destination syslog { file("/var/log/syslog"); };
|
|
destination kern { file("/var/log/kern.log"); };
|
|
destination user { file("/var/log/user.log"); };
|
|
|
|
destination mailinfo { file("/var/log/mail/mail.info"); };
|
|
destination mailwarn { file("/var/log/mail/mail.warn"); };
|
|
destination mailerr { file("/var/log/mail/mail.err"); };
|
|
|
|
destination audit { file("/var/log/audit.log"); };
|
|
destination messages { file("/var/log/messages"); };
|
|
destination emergency { file("/var/log/emergency"); };
|
|
|
|
#destination sshguard { program("/usr/sbin/sshguard -w 2a01:e35:8bb7:3c60::a -w 2a01:e35:8bb7:3c60::2" template("$DATE $FULLHOST $MSGHDR$MESSAGE\n") ); };
|
|
|
|
log { source(src); filter(f_auth); destination(authlog); };
|
|
#log { source(src); filter(f_syslog); destination(syslog); }; # Comment me!
|
|
#log { source(kernsrc); filter(f_kern); destination(kern); };
|
|
|
|
#log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
|
|
#log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
|
|
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };
|
|
|
|
#log { source(src); filter(f_messages); destination(messages); };
|
|
log { source(src); filter(f_emergency); destination(emergency); };
|
|
|
|
#log { source(src); filter(f_sshguard); destination(sshguard); };
|
|
|
|
# Remote loghost
|
|
{% for host in log_hosts %}
|
|
destination loghost{{ loop.index }} { tcp6("{{ host }}"); };
|
|
log { source(src); destination(loghost{{ loop.index }}); };
|
|
{% endfor %}
|
|
|
|
# Source additional configuration files (.conf extension only)
|
|
@include "/etc/syslog-ng/conf.d/*.conf"
|