deprec 2.1.8 → 2.1.10
Sign up to get free protection for your applications and to get access to all the features.
- data/CHANGELOG +14 -0
- data/lib/deprec/recipes/bash.rb +28 -0
- data/lib/deprec/recipes/deprec.rb +4 -0
- data/lib/deprec/recipes/network.rb +2 -1
- data/lib/deprec/recipes/ssh.rb +20 -20
- data/lib/deprec/recipes/stunnel.rb +50 -0
- data/lib/deprec/recipes/syslog_ng.rb +53 -0
- data/lib/deprec/recipes/users.rb +31 -60
- data/lib/deprec/recipes_minus_rails.rb +3 -0
- data/lib/deprec/templates/bash/bash_global +36 -0
- data/lib/deprec/templates/ssh/sshd_config.erb +3 -3
- data/lib/deprec/templates/stunnel/stunnel.conf-client +70 -0
- data/lib/deprec/templates/stunnel/stunnel.conf-orig +66 -0
- data/lib/deprec/templates/stunnel/stunnel.conf-server +70 -0
- data/lib/deprec/templates/stunnel/stunnel4 +11 -0
- data/lib/deprec/templates/stunnel/syslog-server.pem +33 -0
- data/lib/deprec/templates/syslog_ng/syslog-ng.conf-client +363 -0
- data/lib/deprec/templates/syslog_ng/syslog-ng.conf-orig +348 -0
- data/lib/deprec/templates/syslog_ng/syslog-ng.conf-server +345 -0
- metadata +16 -4
@@ -0,0 +1,348 @@
|
|
1
|
+
#
|
2
|
+
# Configuration file for syslog-ng under Debian
|
3
|
+
#
|
4
|
+
# attempts at reproducing default syslog behavior
|
5
|
+
|
6
|
+
# the standard syslog levels are (in descending order of priority):
|
7
|
+
# emerg alert crit err warning notice info debug
|
8
|
+
# the aliases "error", "panic", and "warn" are deprecated
|
9
|
+
# the "none" priority found in the original syslogd configuration is
|
10
|
+
# only used in internal messages created by syslogd
|
11
|
+
|
12
|
+
|
13
|
+
######
|
14
|
+
# options
|
15
|
+
|
16
|
+
options {
|
17
|
+
# disable the chained hostname format in logs
|
18
|
+
# (default is enabled)
|
19
|
+
chain_hostnames(0);
|
20
|
+
|
21
|
+
# the time to wait before a died connection is re-established
|
22
|
+
# (default is 60)
|
23
|
+
time_reopen(10);
|
24
|
+
|
25
|
+
# the time to wait before an idle destination file is closed
|
26
|
+
# (default is 60)
|
27
|
+
time_reap(360);
|
28
|
+
|
29
|
+
# the number of lines buffered before written to file
|
30
|
+
# you might want to increase this if your disk isn't catching with
|
31
|
+
# all the log messages you get or if you want less disk activity
|
32
|
+
# (say on a laptop)
|
33
|
+
# (default is 0)
|
34
|
+
#sync(0);
|
35
|
+
|
36
|
+
# the number of lines fitting in the output queue
|
37
|
+
log_fifo_size(2048);
|
38
|
+
|
39
|
+
# enable or disable directory creation for destination files
|
40
|
+
create_dirs(yes);
|
41
|
+
|
42
|
+
# default owner, group, and permissions for log files
|
43
|
+
# (defaults are 0, 0, 0600)
|
44
|
+
#owner(root);
|
45
|
+
group(adm);
|
46
|
+
perm(0640);
|
47
|
+
|
48
|
+
# default owner, group, and permissions for created directories
|
49
|
+
# (defaults are 0, 0, 0700)
|
50
|
+
#dir_owner(root);
|
51
|
+
#dir_group(root);
|
52
|
+
dir_perm(0755);
|
53
|
+
|
54
|
+
# enable or disable DNS usage
|
55
|
+
# syslog-ng blocks on DNS queries, so enabling DNS may lead to
|
56
|
+
# a Denial of Service attack
|
57
|
+
# (default is yes)
|
58
|
+
use_dns(no);
|
59
|
+
|
60
|
+
# maximum length of message in bytes
|
61
|
+
# this is only limited by the program listening on the /dev/log Unix
|
62
|
+
# socket, glibc can handle arbitrary length log messages, but -- for
|
63
|
+
# example -- syslogd accepts only 1024 bytes
|
64
|
+
# (default is 2048)
|
65
|
+
#log_msg_size(2048);
|
66
|
+
|
67
|
+
#Disable statistic log messages.
|
68
|
+
stats_freq(0);
|
69
|
+
|
70
|
+
# Some program send log messages through a private implementation.
|
71
|
+
# and sometimes that implementation is bad. If this happen syslog-ng
|
72
|
+
# may recognise the program name as hostname. Whit this option
|
73
|
+
# we tell the syslog-ng that if a hostname match this regexp than that
|
74
|
+
# is not a real hostname.
|
75
|
+
bad_hostname("^gconfd$");
|
76
|
+
};
|
77
|
+
|
78
|
+
|
79
|
+
######
|
80
|
+
# sources
|
81
|
+
|
82
|
+
# all known message sources
|
83
|
+
source s_all {
|
84
|
+
# message generated by Syslog-NG
|
85
|
+
internal();
|
86
|
+
# standard Linux log source (this is the default place for the syslog()
|
87
|
+
# function to send logs to)
|
88
|
+
unix-stream("/dev/log");
|
89
|
+
# messages from the kernel
|
90
|
+
file("/proc/kmsg" log_prefix("kernel: "));
|
91
|
+
# use the following line if you want to receive remote UDP logging messages
|
92
|
+
# (this is equivalent to the "-r" syslogd flag)
|
93
|
+
# udp();
|
94
|
+
};
|
95
|
+
|
96
|
+
|
97
|
+
######
|
98
|
+
# destinations
|
99
|
+
|
100
|
+
# some standard log files
|
101
|
+
destination df_auth { file("/var/log/auth.log"); };
|
102
|
+
destination df_syslog { file("/var/log/syslog"); };
|
103
|
+
destination df_cron { file("/var/log/cron.log"); };
|
104
|
+
destination df_daemon { file("/var/log/daemon.log"); };
|
105
|
+
destination df_kern { file("/var/log/kern.log"); };
|
106
|
+
destination df_lpr { file("/var/log/lpr.log"); };
|
107
|
+
destination df_mail { file("/var/log/mail.log"); };
|
108
|
+
destination df_user { file("/var/log/user.log"); };
|
109
|
+
destination df_uucp { file("/var/log/uucp.log"); };
|
110
|
+
|
111
|
+
# these files are meant for the mail system log files
|
112
|
+
# and provide re-usable destinations for {mail,cron,...}.info,
|
113
|
+
# {mail,cron,...}.notice, etc.
|
114
|
+
destination df_facility_dot_info { file("/var/log/$FACILITY.info"); };
|
115
|
+
destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); };
|
116
|
+
destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); };
|
117
|
+
destination df_facility_dot_err { file("/var/log/$FACILITY.err"); };
|
118
|
+
destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); };
|
119
|
+
|
120
|
+
# these files are meant for the news system, and are kept separated
|
121
|
+
# because they should be owned by "news" instead of "root"
|
122
|
+
destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); };
|
123
|
+
destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); };
|
124
|
+
destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); };
|
125
|
+
|
126
|
+
# some more classical and useful files found in standard syslog configurations
|
127
|
+
destination df_debug { file("/var/log/debug"); };
|
128
|
+
destination df_messages { file("/var/log/messages"); };
|
129
|
+
|
130
|
+
# pipes
|
131
|
+
# a console to view log messages under X
|
132
|
+
destination dp_xconsole { pipe("/dev/xconsole"); };
|
133
|
+
|
134
|
+
# consoles
|
135
|
+
# this will send messages to everyone logged in
|
136
|
+
destination du_all { usertty("*"); };
|
137
|
+
|
138
|
+
|
139
|
+
######
|
140
|
+
# filters
|
141
|
+
|
142
|
+
# all messages from the auth and authpriv facilities
|
143
|
+
filter f_auth { facility(auth, authpriv); };
|
144
|
+
|
145
|
+
# all messages except from the auth and authpriv facilities
|
146
|
+
filter f_syslog { not facility(auth, authpriv); };
|
147
|
+
|
148
|
+
# respectively: messages from the cron, daemon, kern, lpr, mail, news, user,
|
149
|
+
# and uucp facilities
|
150
|
+
filter f_cron { facility(cron); };
|
151
|
+
filter f_daemon { facility(daemon); };
|
152
|
+
filter f_kern { facility(kern); };
|
153
|
+
filter f_lpr { facility(lpr); };
|
154
|
+
filter f_mail { facility(mail); };
|
155
|
+
filter f_news { facility(news); };
|
156
|
+
filter f_user { facility(user); };
|
157
|
+
filter f_uucp { facility(uucp); };
|
158
|
+
|
159
|
+
# some filters to select messages of priority greater or equal to info, warn,
|
160
|
+
# and err
|
161
|
+
# (equivalents of syslogd's *.info, *.warn, and *.err)
|
162
|
+
filter f_at_least_info { level(info..emerg); };
|
163
|
+
filter f_at_least_notice { level(notice..emerg); };
|
164
|
+
filter f_at_least_warn { level(warn..emerg); };
|
165
|
+
filter f_at_least_err { level(err..emerg); };
|
166
|
+
filter f_at_least_crit { level(crit..emerg); };
|
167
|
+
|
168
|
+
# all messages of priority debug not coming from the auth, authpriv, news, and
|
169
|
+
# mail facilities
|
170
|
+
filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); };
|
171
|
+
|
172
|
+
# all messages of info, notice, or warn priority not coming form the auth,
|
173
|
+
# authpriv, cron, daemon, mail, and news facilities
|
174
|
+
filter f_messages {
|
175
|
+
level(info,notice,warn)
|
176
|
+
and not facility(auth,authpriv,cron,daemon,mail,news);
|
177
|
+
};
|
178
|
+
|
179
|
+
# messages with priority emerg
|
180
|
+
filter f_emerg { level(emerg); };
|
181
|
+
|
182
|
+
# complex filter for messages usually sent to the xconsole
|
183
|
+
filter f_xconsole {
|
184
|
+
facility(daemon,mail)
|
185
|
+
or level(debug,info,notice,warn)
|
186
|
+
or (facility(news)
|
187
|
+
and level(crit,err,notice));
|
188
|
+
};
|
189
|
+
|
190
|
+
|
191
|
+
######
|
192
|
+
# logs
|
193
|
+
# order matters if you use "flags(final);" to mark the end of processing in a
|
194
|
+
# "log" statement
|
195
|
+
|
196
|
+
# these rules provide the same behavior as the commented original syslogd rules
|
197
|
+
|
198
|
+
# auth,authpriv.* /var/log/auth.log
|
199
|
+
log {
|
200
|
+
source(s_all);
|
201
|
+
filter(f_auth);
|
202
|
+
destination(df_auth);
|
203
|
+
};
|
204
|
+
|
205
|
+
# *.*;auth,authpriv.none -/var/log/syslog
|
206
|
+
log {
|
207
|
+
source(s_all);
|
208
|
+
filter(f_syslog);
|
209
|
+
destination(df_syslog);
|
210
|
+
};
|
211
|
+
|
212
|
+
# this is commented out in the default syslog.conf
|
213
|
+
# cron.* /var/log/cron.log
|
214
|
+
#log {
|
215
|
+
# source(s_all);
|
216
|
+
# filter(f_cron);
|
217
|
+
# destination(df_cron);
|
218
|
+
#};
|
219
|
+
|
220
|
+
# daemon.* -/var/log/daemon.log
|
221
|
+
log {
|
222
|
+
source(s_all);
|
223
|
+
filter(f_daemon);
|
224
|
+
destination(df_daemon);
|
225
|
+
};
|
226
|
+
|
227
|
+
# kern.* -/var/log/kern.log
|
228
|
+
log {
|
229
|
+
source(s_all);
|
230
|
+
filter(f_kern);
|
231
|
+
destination(df_kern);
|
232
|
+
};
|
233
|
+
|
234
|
+
# lpr.* -/var/log/lpr.log
|
235
|
+
log {
|
236
|
+
source(s_all);
|
237
|
+
filter(f_lpr);
|
238
|
+
destination(df_lpr);
|
239
|
+
};
|
240
|
+
|
241
|
+
# mail.* -/var/log/mail.log
|
242
|
+
log {
|
243
|
+
source(s_all);
|
244
|
+
filter(f_mail);
|
245
|
+
destination(df_mail);
|
246
|
+
};
|
247
|
+
|
248
|
+
# user.* -/var/log/user.log
|
249
|
+
log {
|
250
|
+
source(s_all);
|
251
|
+
filter(f_user);
|
252
|
+
destination(df_user);
|
253
|
+
};
|
254
|
+
|
255
|
+
# uucp.* /var/log/uucp.log
|
256
|
+
log {
|
257
|
+
source(s_all);
|
258
|
+
filter(f_uucp);
|
259
|
+
destination(df_uucp);
|
260
|
+
};
|
261
|
+
|
262
|
+
# mail.info -/var/log/mail.info
|
263
|
+
log {
|
264
|
+
source(s_all);
|
265
|
+
filter(f_mail);
|
266
|
+
filter(f_at_least_info);
|
267
|
+
destination(df_facility_dot_info);
|
268
|
+
};
|
269
|
+
|
270
|
+
# mail.warn -/var/log/mail.warn
|
271
|
+
log {
|
272
|
+
source(s_all);
|
273
|
+
filter(f_mail);
|
274
|
+
filter(f_at_least_warn);
|
275
|
+
destination(df_facility_dot_warn);
|
276
|
+
};
|
277
|
+
|
278
|
+
# mail.err /var/log/mail.err
|
279
|
+
log {
|
280
|
+
source(s_all);
|
281
|
+
filter(f_mail);
|
282
|
+
filter(f_at_least_err);
|
283
|
+
destination(df_facility_dot_err);
|
284
|
+
};
|
285
|
+
|
286
|
+
# news.crit /var/log/news/news.crit
|
287
|
+
log {
|
288
|
+
source(s_all);
|
289
|
+
filter(f_news);
|
290
|
+
filter(f_at_least_crit);
|
291
|
+
destination(df_news_dot_crit);
|
292
|
+
};
|
293
|
+
|
294
|
+
# news.err /var/log/news/news.err
|
295
|
+
log {
|
296
|
+
source(s_all);
|
297
|
+
filter(f_news);
|
298
|
+
filter(f_at_least_err);
|
299
|
+
destination(df_news_dot_err);
|
300
|
+
};
|
301
|
+
|
302
|
+
# news.notice /var/log/news/news.notice
|
303
|
+
log {
|
304
|
+
source(s_all);
|
305
|
+
filter(f_news);
|
306
|
+
filter(f_at_least_notice);
|
307
|
+
destination(df_news_dot_notice);
|
308
|
+
};
|
309
|
+
|
310
|
+
|
311
|
+
# *.=debug;\
|
312
|
+
# auth,authpriv.none;\
|
313
|
+
# news.none;mail.none -/var/log/debug
|
314
|
+
log {
|
315
|
+
source(s_all);
|
316
|
+
filter(f_debug);
|
317
|
+
destination(df_debug);
|
318
|
+
};
|
319
|
+
|
320
|
+
|
321
|
+
# *.=info;*.=notice;*.=warn;\
|
322
|
+
# auth,authpriv.none;\
|
323
|
+
# cron,daemon.none;\
|
324
|
+
# mail,news.none -/var/log/messages
|
325
|
+
log {
|
326
|
+
source(s_all);
|
327
|
+
filter(f_messages);
|
328
|
+
destination(df_messages);
|
329
|
+
};
|
330
|
+
|
331
|
+
# *.emerg *
|
332
|
+
log {
|
333
|
+
source(s_all);
|
334
|
+
filter(f_emerg);
|
335
|
+
destination(du_all);
|
336
|
+
};
|
337
|
+
|
338
|
+
|
339
|
+
# daemon.*;mail.*;\
|
340
|
+
# news.crit;news.err;news.notice;\
|
341
|
+
# *.=debug;*.=info;\
|
342
|
+
# *.=notice;*.=warn |/dev/xconsole
|
343
|
+
log {
|
344
|
+
source(s_all);
|
345
|
+
filter(f_xconsole);
|
346
|
+
destination(dp_xconsole);
|
347
|
+
};
|
348
|
+
|
@@ -0,0 +1,345 @@
|
|
1
|
+
#
|
2
|
+
# Configuration file for syslog-ng under Debian
|
3
|
+
#
|
4
|
+
# attempts at reproducing default syslog behavior
|
5
|
+
|
6
|
+
# the standard syslog levels are (in descending order of priority):
|
7
|
+
# emerg alert crit err warning notice info debug
|
8
|
+
# the aliases "error", "panic", and "warn" are deprecated
|
9
|
+
# the "none" priority found in the original syslogd configuration is
|
10
|
+
# only used in internal messages created by syslogd
|
11
|
+
|
12
|
+
|
13
|
+
######
|
14
|
+
# options
|
15
|
+
|
16
|
+
options {
|
17
|
+
# disable the chained hostname format in logs
|
18
|
+
# (default is enabled)
|
19
|
+
chain_hostnames(0);
|
20
|
+
|
21
|
+
keep_hostname(yes);
|
22
|
+
|
23
|
+
# the time to wait before a died connection is re-established
|
24
|
+
# (default is 60)
|
25
|
+
time_reopen(10);
|
26
|
+
|
27
|
+
# the time to wait before an idle destination file is closed
|
28
|
+
# (default is 60)
|
29
|
+
time_reap(360);
|
30
|
+
|
31
|
+
# the number of lines buffered before written to file
|
32
|
+
# you might want to increase this if your disk isn't catching with
|
33
|
+
# all the log messages you get or if you want less disk activity
|
34
|
+
# (say on a laptop)
|
35
|
+
# (default is 0)
|
36
|
+
#sync(0);
|
37
|
+
|
38
|
+
# the number of lines fitting in the output queue
|
39
|
+
log_fifo_size(2048);
|
40
|
+
|
41
|
+
# enable or disable directory creation for destination files
|
42
|
+
create_dirs(yes);
|
43
|
+
|
44
|
+
# default owner, group, and permissions for log files
|
45
|
+
# (defaults are 0, 0, 0600)
|
46
|
+
#owner(root);
|
47
|
+
group(adm);
|
48
|
+
perm(0640);
|
49
|
+
|
50
|
+
# default owner, group, and permissions for created directories
|
51
|
+
# (defaults are 0, 0, 0700)
|
52
|
+
#dir_owner(root);
|
53
|
+
#dir_group(root);
|
54
|
+
dir_perm(0755);
|
55
|
+
|
56
|
+
# enable or disable DNS usage
|
57
|
+
# syslog-ng blocks on DNS queries, so enabling DNS may lead to
|
58
|
+
# a Denial of Service attack
|
59
|
+
# (default is yes)
|
60
|
+
use_dns(no);
|
61
|
+
|
62
|
+
# maximum length of message in bytes
|
63
|
+
# this is only limited by the program listening on the /dev/log Unix
|
64
|
+
# socket, glibc can handle arbitrary length log messages, but -- for
|
65
|
+
# example -- syslogd accepts only 1024 bytes
|
66
|
+
# (default is 2048)
|
67
|
+
#log_msg_size(2048);
|
68
|
+
|
69
|
+
#Disable statistic log messages.
|
70
|
+
stats_freq(0);
|
71
|
+
|
72
|
+
# Some program send log messages through a private implementation.
|
73
|
+
# and sometimes that implementation is bad. If this happen syslog-ng
|
74
|
+
# may recognise the program name as hostname. Whit this option
|
75
|
+
# we tell the syslog-ng that if a hostname match this regexp than that
|
76
|
+
# is not a real hostname.
|
77
|
+
bad_hostname("^gconfd$");
|
78
|
+
};
|
79
|
+
|
80
|
+
|
81
|
+
######
|
82
|
+
# sources
|
83
|
+
|
84
|
+
# all known message sources
|
85
|
+
source s_all {
|
86
|
+
unix-stream("/dev/log");
|
87
|
+
file("/proc/kmsg" log_prefix("kernel: "));
|
88
|
+
udp();
|
89
|
+
tcp(ip(0.0.0.0) port(514) max-connections(300));
|
90
|
+
internal(); # message generated by Syslog-NG
|
91
|
+
};
|
92
|
+
|
93
|
+
|
94
|
+
######
|
95
|
+
# destinations
|
96
|
+
|
97
|
+
# some standard log files
|
98
|
+
destination df_auth { file("/var/log/auth.log"); };
|
99
|
+
destination df_syslog { file("/var/log/syslog"); };
|
100
|
+
destination df_cron { file("/var/log/cron.log"); };
|
101
|
+
destination df_daemon { file("/var/log/daemon.log"); };
|
102
|
+
destination df_kern { file("/var/log/kern.log"); };
|
103
|
+
destination df_lpr { file("/var/log/lpr.log"); };
|
104
|
+
destination df_mail { file("/var/log/mail.log"); };
|
105
|
+
destination df_user { file("/var/log/user.log"); };
|
106
|
+
destination df_uucp { file("/var/log/uucp.log"); };
|
107
|
+
|
108
|
+
# these files are meant for the mail system log files
|
109
|
+
# and provide re-usable destinations for {mail,cron,...}.info,
|
110
|
+
# {mail,cron,...}.notice, etc.
|
111
|
+
destination df_facility_dot_info { file("/var/log/$FACILITY.info"); };
|
112
|
+
destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); };
|
113
|
+
destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); };
|
114
|
+
destination df_facility_dot_err { file("/var/log/$FACILITY.err"); };
|
115
|
+
destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); };
|
116
|
+
|
117
|
+
# these files are meant for the news system, and are kept separated
|
118
|
+
# because they should be owned by "news" instead of "root"
|
119
|
+
destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); };
|
120
|
+
destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); };
|
121
|
+
destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); };
|
122
|
+
|
123
|
+
# some more classical and useful files found in standard syslog configurations
|
124
|
+
destination df_debug { file("/var/log/debug"); };
|
125
|
+
destination df_messages { file("/var/log/messages"); };
|
126
|
+
|
127
|
+
# pipes
|
128
|
+
# a console to view log messages under X
|
129
|
+
destination dp_xconsole { pipe("/dev/xconsole"); };
|
130
|
+
|
131
|
+
# consoles
|
132
|
+
# this will send messages to everyone logged in
|
133
|
+
destination du_all { usertty("*"); };
|
134
|
+
|
135
|
+
|
136
|
+
######
|
137
|
+
# filters
|
138
|
+
|
139
|
+
# all messages from the auth and authpriv facilities
|
140
|
+
filter f_auth { facility(auth, authpriv); };
|
141
|
+
|
142
|
+
# all messages except from the auth and authpriv facilities
|
143
|
+
filter f_syslog { not facility(auth, authpriv); };
|
144
|
+
|
145
|
+
# respectively: messages from the cron, daemon, kern, lpr, mail, news, user,
|
146
|
+
# and uucp facilities
|
147
|
+
filter f_cron { facility(cron); };
|
148
|
+
filter f_daemon { facility(daemon); };
|
149
|
+
filter f_kern { facility(kern); };
|
150
|
+
filter f_lpr { facility(lpr); };
|
151
|
+
filter f_mail { facility(mail); };
|
152
|
+
filter f_news { facility(news); };
|
153
|
+
filter f_user { facility(user); };
|
154
|
+
filter f_uucp { facility(uucp); };
|
155
|
+
|
156
|
+
# some filters to select messages of priority greater or equal to info, warn,
|
157
|
+
# and err
|
158
|
+
# (equivalents of syslogd's *.info, *.warn, and *.err)
|
159
|
+
filter f_at_least_info { level(info..emerg); };
|
160
|
+
filter f_at_least_notice { level(notice..emerg); };
|
161
|
+
filter f_at_least_warn { level(warn..emerg); };
|
162
|
+
filter f_at_least_err { level(err..emerg); };
|
163
|
+
filter f_at_least_crit { level(crit..emerg); };
|
164
|
+
|
165
|
+
# all messages of priority debug not coming from the auth, authpriv, news, and
|
166
|
+
# mail facilities
|
167
|
+
filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); };
|
168
|
+
|
169
|
+
# all messages of info, notice, or warn priority not coming form the auth,
|
170
|
+
# authpriv, cron, daemon, mail, and news facilities
|
171
|
+
filter f_messages {
|
172
|
+
level(info,notice,warn)
|
173
|
+
and not facility(auth,authpriv,cron,daemon,mail,news);
|
174
|
+
};
|
175
|
+
|
176
|
+
# messages with priority emerg
|
177
|
+
filter f_emerg { level(emerg); };
|
178
|
+
|
179
|
+
# complex filter for messages usually sent to the xconsole
|
180
|
+
filter f_xconsole {
|
181
|
+
facility(daemon,mail)
|
182
|
+
or level(debug,info,notice,warn)
|
183
|
+
or (facility(news)
|
184
|
+
and level(crit,err,notice));
|
185
|
+
};
|
186
|
+
|
187
|
+
|
188
|
+
######
|
189
|
+
# logs
|
190
|
+
# order matters if you use "flags(final);" to mark the end of processing in a
|
191
|
+
# "log" statement
|
192
|
+
|
193
|
+
# these rules provide the same behavior as the commented original syslogd rules
|
194
|
+
|
195
|
+
# auth,authpriv.* /var/log/auth.log
|
196
|
+
log {
|
197
|
+
source(s_all);
|
198
|
+
filter(f_auth);
|
199
|
+
destination(df_auth);
|
200
|
+
};
|
201
|
+
|
202
|
+
# *.*;auth,authpriv.none -/var/log/syslog
|
203
|
+
log {
|
204
|
+
source(s_all);
|
205
|
+
filter(f_syslog);
|
206
|
+
destination(df_syslog);
|
207
|
+
};
|
208
|
+
|
209
|
+
# this is commented out in the default syslog.conf
|
210
|
+
# cron.* /var/log/cron.log
|
211
|
+
#log {
|
212
|
+
# source(s_all);
|
213
|
+
# filter(f_cron);
|
214
|
+
# destination(df_cron);
|
215
|
+
#};
|
216
|
+
|
217
|
+
# daemon.* -/var/log/daemon.log
|
218
|
+
log {
|
219
|
+
source(s_all);
|
220
|
+
filter(f_daemon);
|
221
|
+
destination(df_daemon);
|
222
|
+
};
|
223
|
+
|
224
|
+
# kern.* -/var/log/kern.log
|
225
|
+
log {
|
226
|
+
source(s_all);
|
227
|
+
filter(f_kern);
|
228
|
+
destination(df_kern);
|
229
|
+
};
|
230
|
+
|
231
|
+
# lpr.* -/var/log/lpr.log
|
232
|
+
log {
|
233
|
+
source(s_all);
|
234
|
+
filter(f_lpr);
|
235
|
+
destination(df_lpr);
|
236
|
+
};
|
237
|
+
|
238
|
+
# mail.* -/var/log/mail.log
|
239
|
+
log {
|
240
|
+
source(s_all);
|
241
|
+
filter(f_mail);
|
242
|
+
destination(df_mail);
|
243
|
+
};
|
244
|
+
|
245
|
+
# user.* -/var/log/user.log
|
246
|
+
log {
|
247
|
+
source(s_all);
|
248
|
+
filter(f_user);
|
249
|
+
destination(df_user);
|
250
|
+
};
|
251
|
+
|
252
|
+
# uucp.* /var/log/uucp.log
|
253
|
+
log {
|
254
|
+
source(s_all);
|
255
|
+
filter(f_uucp);
|
256
|
+
destination(df_uucp);
|
257
|
+
};
|
258
|
+
|
259
|
+
# mail.info -/var/log/mail.info
|
260
|
+
log {
|
261
|
+
source(s_all);
|
262
|
+
filter(f_mail);
|
263
|
+
filter(f_at_least_info);
|
264
|
+
destination(df_facility_dot_info);
|
265
|
+
};
|
266
|
+
|
267
|
+
# mail.warn -/var/log/mail.warn
|
268
|
+
log {
|
269
|
+
source(s_all);
|
270
|
+
filter(f_mail);
|
271
|
+
filter(f_at_least_warn);
|
272
|
+
destination(df_facility_dot_warn);
|
273
|
+
};
|
274
|
+
|
275
|
+
# mail.err /var/log/mail.err
|
276
|
+
log {
|
277
|
+
source(s_all);
|
278
|
+
filter(f_mail);
|
279
|
+
filter(f_at_least_err);
|
280
|
+
destination(df_facility_dot_err);
|
281
|
+
};
|
282
|
+
|
283
|
+
# news.crit /var/log/news/news.crit
|
284
|
+
log {
|
285
|
+
source(s_all);
|
286
|
+
filter(f_news);
|
287
|
+
filter(f_at_least_crit);
|
288
|
+
destination(df_news_dot_crit);
|
289
|
+
};
|
290
|
+
|
291
|
+
# news.err /var/log/news/news.err
|
292
|
+
log {
|
293
|
+
source(s_all);
|
294
|
+
filter(f_news);
|
295
|
+
filter(f_at_least_err);
|
296
|
+
destination(df_news_dot_err);
|
297
|
+
};
|
298
|
+
|
299
|
+
# news.notice /var/log/news/news.notice
|
300
|
+
log {
|
301
|
+
source(s_all);
|
302
|
+
filter(f_news);
|
303
|
+
filter(f_at_least_notice);
|
304
|
+
destination(df_news_dot_notice);
|
305
|
+
};
|
306
|
+
|
307
|
+
|
308
|
+
# *.=debug;\
|
309
|
+
# auth,authpriv.none;\
|
310
|
+
# news.none;mail.none -/var/log/debug
|
311
|
+
log {
|
312
|
+
source(s_all);
|
313
|
+
filter(f_debug);
|
314
|
+
destination(df_debug);
|
315
|
+
};
|
316
|
+
|
317
|
+
|
318
|
+
# *.=info;*.=notice;*.=warn;\
|
319
|
+
# auth,authpriv.none;\
|
320
|
+
# cron,daemon.none;\
|
321
|
+
# mail,news.none -/var/log/messages
|
322
|
+
log {
|
323
|
+
source(s_all);
|
324
|
+
filter(f_messages);
|
325
|
+
destination(df_messages);
|
326
|
+
};
|
327
|
+
|
328
|
+
# *.emerg *
|
329
|
+
log {
|
330
|
+
source(s_all);
|
331
|
+
filter(f_emerg);
|
332
|
+
destination(du_all);
|
333
|
+
};
|
334
|
+
|
335
|
+
|
336
|
+
# daemon.*;mail.*;\
|
337
|
+
# news.crit;news.err;news.notice;\
|
338
|
+
# *.=debug;*.=info;\
|
339
|
+
# *.=notice;*.=warn |/dev/xconsole
|
340
|
+
log {
|
341
|
+
source(s_all);
|
342
|
+
filter(f_xconsole);
|
343
|
+
destination(dp_xconsole);
|
344
|
+
};
|
345
|
+
|