Syslog-ng.conf--生产环境

# syslog-ng configuration file.
#
# This should behave pretty much like the original syslog on RedHat. But
# it could be configured a lot smarter.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
#
#

options {
  sync(0);
  time_reopen(10);
  log_fifo_size(1024);
  long_hostnames(off);
  use_dns(no);
  use_fqdn(no);
  create_dirs(yes);
  keep_hostname(yes);
  };

source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); };

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog"); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_mlal { usertty("*"); };
destination d_kernel  { file("/var/log/kern"); };

filter f_filter1     { facility(kern); };
filter f_filter2     { level(info) and
                         not (facility(mail)
                             or facility(authpriv)
                             or facility(cron)
                             or program("kernel")); };

filter f_filter3     { facility(authpriv); };
filter f_filter4     { facility(mail); };
filter f_filter5     { level(emerg); };
filter f_filter6     { facility(uucp) or
                     (facility(news) and level(crit)); };
filter f_filter7     { facility(local7); };
filter f_filter8     { facility(cron); };
filter f_kernel      { level(info) and program("kernel"); };

filter windows {
program(MSWinEventLog);
};
destination windows {
file("/var/log/windows/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY"
template("$ISODATE <$FACILITY.$PRIORITY> $HOST $MSG\n")
template_escape(no)
);
};
log {
filter(windows); destination(windows);
flags(final);
};

#log { source(s_sys); filter(f_filter1); destination(d_cons); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_auth); };
log { source(s_sys); filter(f_filter4); destination(d_mail); };
log { source(s_sys); filter(f_filter5); destination(d_mlal); };
log { source(s_sys); filter(f_filter6); destination(d_spol); };
log { source(s_sys); filter(f_filter7); destination(d_boot); };
log { source(s_sys); filter(f_filter8); destination(d_cron); };
log { source(s_sys); filter(f_kernel); destination(d_kernel); };

#source net {
#        udp();
#};

# messages and label it "d_network"
source net {
          tcp(max-connections(5000));
          udp();
};

# Define the destination "d_network" log directory
destination net {
          file ("/var/log/syslog-ng/$YEAR.$MONTH.$DAY/$HOST/$FACILITY.log");
};

# Any logs that match the "s_network" source should be logged
# in the "d_network" directory
log { source(net);
       destination(net);
};

destination d_mysql {
        pipe("/tmp/mysql.pipe"
         template("INSERT INTO syslog_incoming (host, facility, priority, date, time, message) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$MSG' );\n")
         template-escape(yes)
        );
 };

log { source(net); destination(d_mysql); };
log { source(s_sys); destination(d_mysql); };

# vim: syntax=syslog-ng