syslog-ng 過濾設定

ter.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
#
# Note: it also sources additional configuration files (*.conf)
#       located in /etc/syslog-ng/conf.d/

options {
    flush_lines (2000);
    #time_reopen (10);
    log_fifo_size (1000);
    chain_hostnames (off);
    use_dns (no);
    use_fqdn (no);
    owner("root");
    group("adm");
    perm(0640);
    stats_freq(0);
    bad_hostname("^gconfd$");
};

source s_sys {
    system();
    internal();
    # udp(ip(0.0.0.0) port(514));
};

source s_net {
        #tcp(port(514) flags(syslog-protocol));
        udp(port(514) flags(syslog-protocol));
};

destination d_librenms {
        program("/opt/librenms/syslog.php" template ("$HOST||$FACILITY||$PRIORITY||$LEVEL||$TAG||$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC||$MSG||$PROGRAM\n") template-escape(yes));
};

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog" flush_lines(10)); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_kern { file("/var/log/kern"); };
destination d_mlal { usertty("*"); };

destination d_firewall_system { file("/var/log/syslog-ng_remote/IP_${SOURCEIP}_SystemLog"); };
destination d_firewall_traffic { file("/var/log/syslog-ng_remote/IP_${SOURCEIP}_TrafficLog"); };
destination d_imperva_SecurityEvent { file("/var/log/syslog-ng_remote/IP_${SOURCEIP}_SecurityEvent"); };

filter f_kernel     { facility(kern); };
filter f_default    { level(info..emerg) and
                        not (facility(mail)
                        or facility(authpriv)
                        or facility(cron)); };
filter f_auth       { facility(authpriv); };
filter f_mail       { facility(mail); };
filter f_emergency  { level(emerg); };
filter f_news       { facility(uucp) or
                        (facility(news)
                        and level(crit..emerg)); };
filter f_boot   { facility(local7); };
filter f_cron   { facility(cron); };

filter f_firewall_1_traffic {(host(172.28.10.254))};
filter f_firewall_1_system {(host(172.28.10.254)and not match("traffic"))};
filter f_firewall_2_traffic {(host(172.28.100.38))};
filter f_firewall_2_system {(host(172.28.100.38)and not match("TRAFFIC"))};
filter f_imperva_SecurityEvent {(host(172.28.11.200))};
filter f_imperva_SystemEvent {(host(172.28.11.200)and  match("SystemEvent"))};

filter f_noLogToLibrenms1 {(host(172.28.11.200)) };
filter f_noLogToLibrenms2 {(host(172.28.10.254)) };
filter f_noLogToLibrenms3 {(host(172.28.100.38)) };


log {source(s_net);filter(f_firewall_1_traffic);destination(d_firewall_traffic); };
log {source(s_net);filter(f_firewall_1_system);destination(d_firewall_system); };
log {source(s_net);filter(f_firewall_2_traffic);destination(d_firewall_traffic); };
log {source(s_net);filter(f_firewall_2_system);destination(d_firewall_system);;};
log {source(s_net);filter(f_imperva_SecurityEvent);destination(d_imperva_SecurityEvent); };
log {source(s_net);filter(f_imperva_SystemEvent);destination(d_firewall_system);;};
log {source(s_net); filter(f_firewall_1_system); destination(d_librenms);};
log {source(s_net); filter(f_firewall_2_system); destination(d_librenms);};
log {source(s_net); filter(f_imperva_SystemEvent); destination(d_librenms);};


log {
        source(s_net);
        source(s_sys);
        filter(f_noLogToLibrenms1);
        filter(f_noLogToLibrenms2);
        filter(f_noLogToLibrenms3);
        destination(d_librenms);

};



# Source additional configuration files (.conf extension only)
@include "/etc/syslog-ng/conf.d/*.conf"


# vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:
[root@localhost syslog-ng]#