Index: cookbooks/syslog-ng/templates/default/syslog-ng-server.conf.erb =================================================================== --- cookbooks/syslog-ng/templates/default/syslog-ng-server.conf.erb (revision 31863) +++ cookbooks/syslog-ng/templates/default/syslog-ng-server.conf.erb (working copy) @@ -4,10 +4,10 @@ options { sync (0); time_reopen (10); - time_reap(360); +# time_reap(360); log_fifo_size (4096); long_hostnames (off); - chain_hostnames(0); +# chain_hostnames(0); use_dns (no); use_fqdn (no); create_dirs (no); @@ -23,7 +23,7 @@ }; destination d_cons { file("/dev/console"); }; -destination d_mesg { file("/var/log/syslog"); file("/var/log/messages"); }; +destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure/secure"); }; destination d_sudo { file("/var/log/secure/sudo"); }; destination d_krb { file("/var/log/secure/krb"); }; @@ -33,35 +33,44 @@ destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_php { file("/var/log/php" perm(0644)); }; +destination d_php_info { file("/var/log/php-info.log" perm(0644)); }; destination d_httpd { file("/var/log/httpd" perm(0644)); }; +destination d_httpd_info { file("/var/log/httpd-info.log" perm(0644)); }; destination d_moli { file("/var/log/people/moli.log" perm(0755)); }; destination d_linksug { file("/var/log/linksuggest.log" perm(0755)); }; destination mail-alert { program("/root/syslog/syslog-mail.pl"); }; -#destination d_iowa { file("/var/log/iowa-network" perm(0644)); }; +destination d_iowa { file("/var/log/iowa-network" perm(0644)); }; destination d_newsidebar { file("/var/log/newsidebar.log" perm(0755)); }; destination d_inez { file("/var/log/people/inez.log" perm(0755)); }; destination d_nef { file("/var/log/people/nef.log" perm(0755)); }; destination d_hawelcome { file("/var/log/hawelcome.log" perm(0755)); }; destination d_puppet { file("/var/log/puppet" perm(0755)); }; destination d_named { file("/var/log/named" perm(0755)); }; -#destination d_athena_httpd { file("/var/log/athena/httpd" perm(0644)); }; -#destination d_athena_php { file("/var/log/athena/php" perm(0644)); }; -#destination d_athena_js { file("/var/log/athena/js.log" perm(0644)); }; -#destination d_sjc_net_eqpt { file("/var/log/sjc-net.log" perm(0644)); }; +destination d_athena_httpd { file("/var/log/athena/httpd" perm(0644)); }; +destination d_athena_php { file("/var/log/athena/php" perm(0644)); }; +destination d_athena_js { file("/var/log/athena/js.log" perm(0644)); }; +destination d_sjc_net_eqpt { file("/var/log/sjc-net.log" perm(0644)); }; +destination d_dev { file("/var/log/dev.log" perm(0755)); }; +destination d_openx_httpd { file("/var/log/openx/httpd.log" perm(0644)); }; +destination d_openx_php { file("/var/log/openx/php.log" perm(0644)); }; destination d_thumb { file("/var/log/thumbnailers.log" perm(0644)); }; destination d_onedot { file("/var/log/onedot.log" perm(0644)); }; destination d_riak { file("/var/log/riak/riak_combined.log" perm(0644)); }; #filter f_filter1 { facility(kern); }; -filter f_php { ( match(': PHP ') or match (': DBQueryError') ) and not match('MOLI') and not match('NewSidebar') and not match(':\s+Inez') and not match('PHP Notice:\s+Nef') and not match('proto=ESMTP'); }; +filter f_php { ( match('PHP Fatal') or match('PHP Warning') or match('PHP Catchable fatal') or match (': DBQueryError') ) and not ( host('liftium-') or host('dev-') or host('openxap') or host('ap-v')); }; +filter f_php_info { match(': PHP ') and not ( match('PHP Fatal') or match('PHP Warning') or match('PHP Catchable fatal') ) and not match('MOLI') and not match('NewSidebar') and not match(':\s+Inez') and not match('PHP Notice:\s+Nef') and not match('proto=ESMTP') and not ( host('liftium-') or host('dev-') or host('openxap') or host('ap-v')); }; +match(':\s+Inez') and not match('PHP Notice:\s+Nef') and not match('proto=ESMTP'); }; filter f_moli { match('MOLI'); }; filter f_linksug { match('Linksuggest'); }; -filter f_php_e { match('PHP Fatal') or match('PHP Catchable fatal') or match('Segmentation fault'); }; -filter f_httpd { ( match('httpd') or match ('apache') ) and not match(': PHP') and not match('MOLI') and not match('NewSidebar') and not match(':\s+Inez') and not match('PHP Notice:\s+Nef') and not match('HAWelcomeJob') and not match (': DBQueryError'); }; +filter f_php_e { ( match('PHP Fatal') or match('PHP Catchable fatal') or match('Segmentation fault') ) and not (host('dev-') or host('ap-v')); }; +filter f_httpd { level(warn..emerg) and ( ( match('httpd') or match ('apache') ) and not match(': PHP') and not match('MOLI') and not match('NewSidebar') and not match(':\s+Inez') and not match('PHP Notice:\s+Nef') and not match('HAWelcomeJob') and not match (': DBQueryError') and host('ap-s') and not ( host('liftium-') or host('dev-') or host('openxap') or host('ap-staging') or host('ap-staff') or host('ap-v')) ); }; +filter f_httpd_info { level(debug..notice) and ( ( match('httpd') or match ('apache') ) and not match(': PHP') and not match('MOLI') and not match('NewSidebar') and not match(':\s+Inez') and not match('PHP Notice:\s+Nef') and not match('HAWelcomeJob') and not match (': DBQueryError') and not ( host('liftium-') or host('dev-') or host('openxap') or host('ap-v') ) ); }; +match(':\s+Inez') and not match('PHP Notice:\s+Nef') and not match('HAWelcomeJob') and not match (': DBQueryError'); }; filter f_sudo { match('su:') or match('sudo:'); }; filter f_krb { match('krb5'); }; -filter f_filter2 { level(debug..emerg) and - not facility(mail,authpriv,cron) and not match('PHP') and not match('httpd') and not match ('apache2') and not match('puppetd') and not match('puppetmasterd') and not match('named') and not match('thumb-') and not match('onedot'); }; +filter f_filter2 { level(debug..emerg) and not facility(mail,authpriv,cron) and not match('PHP') and not match('httpd') and not match ('apache2') and not match('named') and not match('thumb-'); }; +not match('puppetmasterd') and not match('named') and not match('thumb-') and not match('onedot'); }; filter f_auth { facility(authpriv) and not match('su:') and not match('sudo:') and not match('krb5'); }; filter f_filter4 { facility(mail) or match('proto=ESMTP'); }; filter f_filter5 { level(emerg); }; @@ -69,19 +78,23 @@ (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; -#filter f_iowa { netmask('10.6.0.0/255.255.0.0'); }; +filter f_iowa { netmask('10.6.0.0/255.255.0.0'); }; filter f_newsidebar { match('NewSidebar'); }; filter f_inez { match(':\s+Inez') or match('ReverseParser:'); }; filter f_nef { match('PHP Notice:\s+Nef'); }; filter f_hawelcome { match('HAWelcomeJob'); }; filter f_puppet { match('puppetd') or match('puppetmasterd'); }; filter f_named { match('namedd'); }; -#filter f_athena_http { ( host('10.8.2.64') or host('10.8.2.72') or host('10.8.2.73') ) and match ('apache2') and not match(' PHP'); }; -#filter f_athena_php { ( host('10.8.2.64') or host('10.8.2.72') or host('10.8.2.73') ) and match(' PHP') and not match(' JS_ERROR') and not match (' TAG_ERROR'); }; -#filter f_athena_js { ( host('10.8.2.64') or host('10.8.2.72') or host('10.8.2.73') ) and ( match(' JS_ERROR') or match (' TAG_ERROR') ); }; -#filter f_sjc_net_eqpt { netmask('10.8.3.0/255.255.255.0'); }; +filter f_athena_http { host('liftium-s') and match ('apache2') and not match(' PHP'); }; +filter f_athena_php { host('liftium-s') and match(' PHP') and not match(' JS_ERROR') and not match (' TAG_ERROR'); }; +filter f_athena_js { host('liftium-s') and ( match(' JS_ERROR') or match (' TAG_ERROR') ); }; +filter f_sjc_net_eqpt { netmask('10.8.3.0/255.255.255.0'); }; +filter f_dev { host('dev-') or match('thumb-dev'); }; +filter f_openx_http { host('openxap-s') and match ('apache2') and not match(' PHP'); }; +filter f_openx_php { host('openxap-s') and match(' PHP'); }; filter f_thumb { match('thumb-api') or match('thumb-cron'); }; -filter f_onedot { match('onedot\['); }; +filter f_ash_php { ( match(': PHP') or match (': DBQueryError') ) and host('ap-v'); }; +filter f_ash_httpd { host('ap-v') and match ('apache') and not match(': PHP'); }; filter f_riak { match('riak_log'); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; @@ -93,25 +106,30 @@ log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(f_php); destination(d_php); }; +log { source(s_sys); filter(f_php_info); destination(d_php_info); }; log { source(s_sys); filter(f_httpd); destination(d_httpd); }; +log { source(s_sys); filter(f_httpd_info); destination(d_httpd_info); }; log { source(s_sys); filter(f_php_e); destination(mail-alert); }; log { source(s_sys); filter(f_sudo); destination(d_sudo); }; log { source(s_sys); filter(f_krb); destination(d_krb); }; log { source(s_sys); filter(f_moli); destination(d_moli); }; log { source(s_sys); filter(f_linksug); destination(d_linksug); }; -#log { source(s_sys); filter(f_iowa); destination(d_iowa); }; +log { source(s_sys); filter(f_iowa); destination(d_iowa); }; log { source(s_sys); filter(f_newsidebar); destination(d_newsidebar); }; log { source(s_sys); filter(f_inez); destination(d_inez); }; log { source(s_sys); filter(f_nef); destination(d_nef); }; log { source(s_sys); filter(f_hawelcome); destination(d_hawelcome); }; -log { source(s_sys); filter(f_puppet); destination(d_puppet); }; log { source(s_sys); filter(f_named); destination(d_named); }; -#log { source(s_sys); filter(f_athena_http); destination(d_athena_httpd); }; -#log { source(s_sys); filter(f_athena_php); destination(d_athena_php); }; -#log { source(s_sys); filter(f_athena_js); destination(d_athena_js); }; -#log { source(s_sys); filter(f_sjc_net_eqpt); destination(d_sjc_net_eqpt); }; +log { source(s_sys); filter(f_athena_http); destination(d_athena_httpd); }; +log { source(s_sys); filter(f_athena_php); destination(d_athena_php); }; +log { source(s_sys); filter(f_athena_js); destination(d_athena_js); }; +log { source(s_sys); filter(f_sjc_net_eqpt); destination(d_sjc_net_eqpt); }; +log { source(s_sys); filter(f_dev); destination(d_dev); }; +log { source(s_sys); filter(f_openx_http); destination(d_openx_httpd); }; +log { source(s_sys); filter(f_openx_php); destination(d_openx_php); }; log { source(s_sys); filter(f_thumb); destination(d_thumb); }; -log { source(s_sys); filter(f_onedot); destination(d_onedot); }; +log { source(s_sys); filter(f_ash_php); destination(d_ash_php); }; +log { source(s_sys); filter(f_ash_httpd); destination(d_ash_httpd); }; log { source(s_sys); filter(f_riak); destination(d_riak); }; #cisco