# /etc/syslog-ng/syslog-ng.conf
# From the Gentoo Linux Security Guide
# http://www.gentoo.org/doc/en/gentoo-security.xml
# Creative Commons - Attribution / Share Alike License
# http://creativecommons.org/licenses/by-sa/2.0

options { chain_hostnames(off); create_dirs (yes); sync(0); stats(43200); };

#source where to read log
source src { unix-stream("/dev/log"); internal(); };
source kernsrc { file("/proc/kmsg"); };

#define destinations
#destination remote_server { udp("10.0.0.2" port(514)); };
destination authlog  { udp("192.168.1.134" port(514)); };
destination syslog { udp("192.168.1.134" port(514)); };

destination cron { udp("192.168.1.134" port(514)); };

destination daemon { udp("192.168.1.134" port(514)); };

destination kern { udp("192.168.1.134" port(514)); };

destination lpr { udp("192.168.1.134" port(514)); };

destination user { udp("192.168.1.134" port(514)); };

# Should be maillog (Without dot) as it was the default on logwatch
destination mail  { udp("192.168.1.134" port(514)); };

destination mailinfo { udp("192.168.1.134" port(514)); };

destination mailwarn { udp("192.168.1.134" port(514)); };

destination mailerr { udp("192.168.1.134" port(514)); };
destination newscrit { udp("192.168.1.134" port(514)); };

destination newserr { udp("192.168.1.134" port(514)); };

destination newsnotice { udp("192.168.1.134" port(514)); };


destination debug { udp("192.168.1.134" port(514)); };

destination messages { udp("192.168.1.134" port(514)); };
destination console { usertty("root"); };
destination console_all { file("/dev/tty12"); };
destination xconsole { pipe("/dev/xconsole"); };

#create filters
filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
filter f_syslog { not facility(authpriv, mail); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_user { facility(user); };
filter f_debug { not facility(auth, authpriv, news, mail); };
filter f_messages { level(info..warn) 
	and not facility(auth, authpriv, mail, news); };
filter f_emergency { level(emerg); };

filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };
filter f_failed { match("failed"); };
filter f_denied { match("denied"); };

#connect filter and destination
log { source(src); filter(f_authpriv); destination(authlog); };
log { source(src); filter(f_syslog); destination(syslog); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_daemon); destination(daemon); };
log { source(kernsrc); filter(f_kern); destination(kern); };
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_user); destination(user); };
log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };

log { source(src); filter(f_debug); destination(debug); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };

#default log
log { source(src); destination(console_all); };