/*
 * dsyslog example config.
 * Comments are either C-style (like this block), C++ style (//) or
 * shell style (#).
 *
 * This file aims to be a drop-in replacement for syslogd. --nenolod
 */

/*
 * loadmodule controls what modules are loaded into dsyslog.
 */
loadmodule "source_localsock.so";
loadmodule "source_mark.so";
loadmodule "source_klogfile.so";
loadmodule "source_udp.so";
loadmodule "filter_dropprog.so";
loadmodule "filter_regexp.so";
loadmodule "filter_droppriority.so";
loadmodule "output_file.so";
loadmodule "output_udp.so";
loadmodule "cond_literal.so";
loadmodule "cond_pattern.so";

/* Uncomment this to use condition counter.
 * condition counter { set me; }; # Sets internal counter
 * condition counter { test set; }; # Fails if counter isn't set
 * condition counter { test !set; }; # Fails if counter is set
 * This is useful for implementing /var/log/messages as a fallback rule.
 */
#loadmodule "cond_counter.so";

/*
 * sources define where dsyslog gets it's data:
 * this one adds the syslogd socket.
 */
source localsock { path "/dev/log"; };

/*
 * this one adds the kernel log buffer, /proc/kmsg.
 */
source klogfile { path "/proc/kmsg"; };

/*
 * this one adds a source that generates "-- MARK --" which
 * runs on a timer. it is for those who found that feature useful
 * in syslogd.
 */
source mark { };

/*
 * this one adds a udp listener. as such it's commented out.
 */
#source udp { host 0.0.0.0; port 514; };

/* you can use the dropprog filter to drop syslog messages
 * from programs you don't care about entirely. for example,
 * to drop logs from sudo, uncomment the line below.
 */
#filter dropprog { program sudo; };

/*
 * you can also use the droppriority filter to drop syslog messages by
 * BSD syslog facility and severity. At present, you must specify both.
 */
#filter droppriority { facility auth; severity notice; };

/*
 * you can also filter by regexp; thanks to micah for the regexp.
 * if enabled, this will replace all IPv4 IPs in your logs with 0.0.0.0.
 *
 * in some countries, it is recommended to do this, and infact is generally
 * considered a best practice. in several countries (USA, UK, etc), ip addresses
 * are seen as personal data and are covered under privacy protection laws.
 * by filtering them, you may not be subject to those laws.
 */
#filter regexp {
#  message "(25[0-5]|2[0-4][0-9]|[0-1]?[0-9]?[0-9])([\\.\\-](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]?[0-9])){3}";
#  replace "0.0.0.0";
#};

/*
 * this appends entries to /var/log/messages like sysklogd on debian, except for
 * kernel entries.
 */
output file { path "/var/log/messages"; condition literal { program !kernel; }; };

/*
 * this one is for /var/log/kern.log.
 */
output file { path "/var/log/kern.log"; condition literal { program kernel; }; };

/*
 * this one uses pattern matching to put postfix and qpopper logs in /var/log/mail.log.
 */
output file { path "/var/log/mail.log"; condition pattern { program "postfix*"; }; };
output file { path "/var/log/mail.log"; condition literal { program "in.qpopper"; }; };

/*
 * Log to MySQL.
 *
 * You can use conditionals here too, but why bother? It's SQL.
 */
#loadmodule "output_mysql.so";
#output mysql { dbhost localhost; dbport 3306; dbuser sysloguser; dbpass syslogpass; dbname syslogs; };
