I am trying to get my firewall to log to a Syslog-NG box I have setup. I
have local services logging to the appropriate files, and also have them
going to a MySQL database.
I have configured TCP and UDP sources and verified that Syslog-NG is
listening on those ports.
For some reason I am not seeing any entries from my Firewall on my
syslog box. Here's my config. Any help is much appreciated!
options { sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (yes);
keep_hostname (yes);
};
source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream
("/dev/log"); internal(); };
source s_tcp { tcp(ip(10.100.3.121) port(5140) max-connections(100)); };
source s_udp { udp(ip(10.100.3.121) port(514)); };
destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog"); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_mlal { usertty("*"); };
destination d_kernel { file("/var/log/kern"); };
destination d_tcp {
file("/var/log/remote/$HOST/$YEAR.$MONTH.$DAY/$FACILITY"); };
destination d_udp {
file("/var/log/remote/$HOST/$YEAR.$MONTH.$DAY/$FACILITY"); };
destination d_mysql {
pipe("/var/log/mysql.pipe"
template("INSERT INTO logs
(host, facility, priority, level, tag, datetime, program, msg)
VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG',
'$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC',
l '$PROGRAM', '$MSG' );\n") template-escape(yes));
};
filter f_filter1 { facility(kern); };
filter f_filter2 { level(info) and
not (facility(mail)
or facility(authpriv)
or facility(cron)
or program("kernel")); };
filter f_filter3 { facility(authpriv); };
filter f_filter4 { facility(mail); };
filter f_filter5 { level(emerg); };
filter f_filter6 { facility(uucp) or
(facility(news) and level(crit)); };
filter f_filter7 { facility(local7); };
filter f_filter8 { facility(cron); };
filter f_kernel { level(info) and program("kernel"); };
log { source(s_sys); filter(f_filter1); destination(d_cons); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_auth); };
log { source(s_sys); filter(f_filter4); destination(d_mail); };
log { source(s_sys); filter(f_filter5); destination(d_mlal); };
log { source(s_sys); filter(f_filter6); destination(d_spol); };
log { source(s_sys); filter(f_filter7); destination(d_boot); };
log { source(s_sys); filter(f_filter8); destination(d_cron); };
log { source(s_sys); filter(f_kernel); destination(d_kernel); };
log { source(s_tcp); destination(d_tcp); };
log { source(s_tcp); destination(d_mysql); };
log { source(s_udp); destination(d_udp); };
log { source(s_udp); destination(d_mysql); };
log { source(s_sys); destination(d_mysql); };
Jamie Furtner wrote:
What are you trying to do?
Jamie
On Tue, February 21, 2006 3:11 pm, Ben Ruset wrote:
Any syslog-NG gurus on the list?
