This is my syslog-ng.conf:
@version: 3.0
#
# Syslog-ng configuration file, compatible with default Debian syslogd
# installation. Originally written by anonymous (I can't find his name)
# Revised, and rewrited by me (SZALAY Attila <
sasa@debian.org>)
###########################################################################################
# Clay's LogZilla config below
###########################################################################################
# Last updated on 2010-06-15
###########################################################################################
# First, set some global options.
options {
long_hostnames(off);
# doesn't actually help on Solaris, log(3) truncates at 1024 chars
log_msg_size(8192);
# buffer just a little for performance
# sync(1); <- Deprecated - use flush_lines() instead
flush_lines(1);
# memory is cheap, buffer messages unable to write (like to loghost)
log_fifo_size(16384);
# Hosts we don't want syslog from
#bad_hostname("^(ctld.|cmd|tmd|last)$");
# The time to wait before a dead connection is reestablished (seconds)
time_reopen(10);
#Use DNS so that our good names are used, not hostnames
use_dns(yes);
dns_cache(yes);
#Use the whole DNS name
use_fqdn(yes);
keep_hostname(yes);
chain_hostnames(no);
#Read permission for everyone
perm(0644);
# The default action of syslog-ng 1.6.0 is to log a STATS line
# to the file every 10 minutes. That's pretty ugly after a while.
# Change it to every 12 hours so you get a nice daily update of
# # how many messages syslog-ng missed (0).
# stats(43200);
};
########################
# Sources
########################
source s_all {
internal ();
unix-dgram ("/dev/log");
unix-stream ("/dev/log");
file ("/proc/kmsg" program_override("kernel"));
tcp (ip(*** REMOVED ***) port(5140) keep-alive(yes));
udp ();
};
##############################################################################
# Destinations:
# Note: LogZilla will ONLY process log entries in this format.
# You can't run db_insert.pl on any log file without using this template.
# The reason is that messages vary in composition so the tab delimiters are
# needed to determine the tokens.
##############################################################################
destination d_logzilla {
program("/var/www/logzilla/scripts/db_insert.pl"
template("$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n")
template_escape(yes)
);
};
################################################
# LOG:
# Tell syslog-ng to log to our new destination
################################################
log {
source(s_all);
destination(d_logzilla);
};
