/etc/dsyslog.conf is in dsyslog 0.6.0build2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 | /*
* dsyslog example config for Debian.
*
* Comments are either C-style (like this block), C++ style (//) or
* shell style (#).
*
* This file serves to be a drop-in replacement for most sites using
* sysklogd. For the uninitiated, dsyslog creates a series of streams
* which go from sources and get routed to many sinks. In between, there
* are filters, which act on all messages, and conditionals, which control
* whether or not an output accepts that message. This can be compared to
* for example syslog-ng's architecture.
*
* So, it's a little different than traditional sysklogd.
*/
/*
* loadmodule controls what modules are loaded into dsyslog.
*/
loadmodule "source_localsock.so";
loadmodule "source_mark.so";
loadmodule "source_klogfile.so";
loadmodule "source_udp.so";
loadmodule "filter_dropprog.so";
loadmodule "filter_droppriority.so";
loadmodule "filter_regexp.so";
loadmodule "output_file.so";
loadmodule "output_udp.so";
loadmodule "cond_literal.so";
loadmodule "cond_pattern.so";
/*
* sources define where dsyslog gets it's data:
* this one adds the syslogd socket.
*/
source localsock { path "/dev/log"; };
/*
* this one adds the kernel log buffer, /proc/kmsg.
*/
source klogfile { path "/proc/kmsg"; };
/*
* this one adds a source that generates "-- MARK --" which
* runs on a timer. it is for those who found that feature useful
* in syslogd.
*/
source mark;
/*
* this one adds a udp listener. as such it's commented out.
*/
#source udp { host 0.0.0.0; port 514; };
/*
* you can use the dropprog filter to drop syslog messages
* from programs you don't care about entirely. for example,
* to drop logs from NetworkManager, uncomment the line below.
*/
#filter dropprog { program NetworkManager; };
/*
* you can also use the droppriority filter to drop syslog messages by
* BSD syslog facility and severity. At present, you must specify both.
*/
#filter droppriority { facility auth; severity notice; };
/*
* you can also filter by regexp; thanks to micah for the regexp.
* if enabled, this will replace all IPv4 IPs in your logs with 0.0.0.0.
*
* in some countries, it is recommended to do this, and infact is generally
* considered a best practice. in several countries (USA, UK, etc), ip addresses
* are seen as personal data and are covered under privacy protection laws.
* by filtering them, you may not be subject to those laws.
*/
#filter regexp {
# message "(25[0-5]|2[0-4][0-9]|[0-1]?[0-9]?[0-9])([\\.\\-](25[0-5]|2[0-4][0-9]|[0-1]?[0-9]?[0-9])){3}";
# replace "0.0.0.0";
#};
# auth,authpriv.* /var/log/auth.log
output file {
path "/var/log/auth.log";
condition pattern { facility "auth*"; };
};
# *.*;auth,authpriv.none -/var/log/syslog
output file {
path "/var/log/syslog";
condition pattern { facility "!auth*"; };
};
# cron.* /var/log/cron.log
# This is commented out in the sysklogd config.
#output file {
# path "/var/log/cron.log";
# condition literal { facility cron; };
#};
# daemon.* -/var/log/daemon.log
output file {
path "/var/log/daemon.log";
condition literal { facility daemon; };
};
# kern.* -/var/log/kern.log
output file {
path "/var/log/kern.log";
condition literal { facility kernel; };
};
# lpr.* -/var/log/lpr.log
output file {
path "/var/log/lpr.log";
condition literal { facility lpr; };
};
# mail.* -/var/log/mail.log
output file {
path "/var/log/mail.log";
condition literal { facility mail; };
};
# user.* -/var/log/user.log
output file {
path "/var/log/user.log";
condition literal { facility user; };
};
# everything else.
output file {
path "/var/log/messages";
condition literal { facility !kernel; };
};
/*
* MySQL example. You need dsyslog-module-mysql installed for this.
*/
#loadmodule "output_mysql.so";
#output mysql { dbhost localhost; dbport 3306; dbuser sysloguser; dbpass syslogpass; dbname syslogs; };
/*
* PostgreSQL example. You need dsyslog-module-postgresql installed for this.
*/
#loadmodule "output_postgres.so";
#output postgres { dbhost localhost; dbport 3306; dbuser sysloguser; dbpass syslogpass; dbname syslogs; };
|