Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Syslog-ng 3.6.4 configuration
@version:3.6
@include "scl.conf"
options {
flush-timeout(2000);
chain-hostnames(no);
use-dns(yes);
use-fqdn(no);
create-dirs(yes);
keep-hostname(yes);
frac-digits(3);
time-reap(3);
time-reopen(2);
log-fifo-size(8192000);
log-msg-size(2097152);
mark-mode(none);
stats-level(1);
stats-freq(0);
suppress(0);
};
# syslog relay
filter emergency { level(emerg); };
source self_syslog {
file("/proc/kmsg" program-override("kernel") flags(kernel));
unix-dgram("/dev/log" keep-timestamp(no));
internal();
};
destination syslog_log { file("/var/log/syslog/$HOST/$FACILITY/$YEAR$MONTH$DAY-$FACILITY.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); };
destination console { usertty("root"); };
destination syslog_host-siteb { syslog('1.2.6.1' transport(tcp) port(1514)); };
log { source(self_syslog); filter(emergency); destination(console); };
log { source(self_syslog); destination(syslog_log); destination(syslog_host-siteb); };
# gelf relay
filter no_host { "${host}" eq "" };
filter no_timestamp { "${timestamp}" eq "" };
block source self-gelf-channel() {
channel {
source {
network(ip(127.0.0.1) transport(udp) port(12201) flags(no-parse, validate-utf8) log-iw-size(51200) log-fetch-limit(100));
unix-stream("/var/run/gelf.sock" flags(no-parse, validate-utf8) log-iw-size(51200) log-fetch-limit(100));
};
parser { json-parser(); };
rewrite {
set("host-sitea", value("host"));
set("${UNIXTIME}", value("timestamp") condition(filter(no_timestamp)));
};
flags(final);
};
};
template t_relay_gelf { template("$(format-json --pair version='1.1' --key host --pair timestamp=double(${timestamp}) --pair level=int(${level:-1}) --key short_message --key full_message --key _*)$(literal '\0')"); };
template t_self_gelf { template("$(format-json --key host --pair timestamp=double(${timestamp}) --pair level=int(${level:-1}) --key short_message --key full_message --key _*)\n"); };
source self_gelf { self-gelf-channel(); };
destination gelf_log { file("/var/log/syslog/$host/gelf/$YEAR$MONTH$DAY-gelf.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template(t_self_gelf)); };
destination gelf_host-siteb { network('1.2.6.1' transport(tcp) port(12201) template(t_relay_gelf)); };
log { source(self_gelf); destination(gelf_log); destination(gelf_host-siteb); };
# syslog server
filter xen_xapi { program('xapi'); };
filter xen_xenstored { program('xenstored'); };
filter for_sec { not (level(debug) or facility(local6) or facility(local3) or filter(xen_xapi) or filter(xen_xenstored) or program("RT_FLOW")); };
filter syslog_relay { not program('RT_FLOW'); };
block source remote-gelf-channel() {
channel {
source {
network(ip("1.1.6.1") transport(tcp) port(12201) flags(no-parse) so_rcvbuf(8388608) max-connections(512) log-iw-size(512000) log-fetch-limit(2000));
};
parser { json-parser(); };
rewrite {
set("${HOST}", value("host"));
set("${UNIXTIME}", value("timestamp") condition(filter(no_timestamp)));
};
flags(final);
};
};
source remote_syslog {
syslog(ip("1.1.6.1") transport(udp) port(514) so_rcvbuf(8388608) log-iw-size(512000) log-fetch-limit(2000));
syslog(ip("1.1.6.1") transport(tcp) port(1514) max-connections(512) so_rcvbuf(8388608) log-iw-size(512000) log-fetch-limit(2000));
};
source remote_gelf {
remote-gelf-channel();
};
destination sec { program('/usr/bin/sec --input=- --debug=4 --intevents --log /var/log/syslog/sec.log --conf /etc/sec/\*.rules --quoting'); };
log { source(remote_syslog); destination(syslog_log); };
log { source(remote_gelf); destination(gelf_log); };
log { source(self_syslog); source(remote_syslog); filter(for_sec); destination(sec); };
# relay to graylog
destination graylog_syslog_sitea { syslog('1.1.6.3' transport(tcp) port(1514)); };
destination graylog_gelf_sitea { network('1.1.6.3' transport(tcp) port(12201) template(t_relay_gelf)); };
log { source(self_syslog); source(remote_syslog); filter(syslog_relay); destination(graylog_syslog_sitea); };
log { source(self_gelf); source(remote_gelf); destination(graylog_gelf_sitea); };
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment