The syslog-ng Premium Edition 4 F1 Administrator Guide

Introduction to syslog-ng · `context-timeout`

<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8
<priority>VERSION ISOTIMESTAMP HOSTNAME APPLICATION PID MESSAGEID STRUCTURED-DATA MSG
[exampleSDID@0 iut="3" eventSource="Application" eventID="1011"][examplePriority@0 class="high"]
PATH=/opt/syslog-ng/bin:$PATH 
PATH=/opt/syslog-ng/bin:$PATH 
./syslog-ng-premium-edition-<version>.run -- [options]
rpm -U syslog-ng-premium-edition-<version>-<OS>-<arch>.rpm
rpm -i syslog-ng-premium-edition-<version>-<OS>-<arch>.rpm
/etc/init.d/syslogd stop
/etc/init.d/syslog-ng start
errnotify:
en_name = "syslog1"
en_persistenceflg = 1
en_method = "logger Msg from Error Log: `errpt -l $1 | grep -v 'ERROR_ID TIMESTAMP'`"
Incompatible syslog-ng package already installed
Incompatible standalone (.run) installer of syslog-ng Premium Edition
Incompatible syslog-ng package already installed
Errors were encountered while processing
This version of syslog-ng Premium Edition doesn't support storing messages in SQL servers, while the installed one did.
source s_myfilesource { 
        file("/var/log/myapplication.log" follow_freq(1)); };
source s_local {
        system();
        internal();
};
destination d_network { udp("10.1.2.3"); };
destination d_network {syslog(ip("10.1.2.3") transport("tcp"); };
log { 
        source(s_local); destination(d_network); };
destination d_local {
    file("/var/log/messages"); };
log {
    source(s_local); destination(d_local);
@version: 4.1
@include "scl.conf"
source s_local { system(); internal(); };
destination d_local {
            file("/var/log/messages"); };
log { source(s_local); destination(d_local); };
@version: 4.1
@include "scl.conf"
source s_local { system(); internal(); };
destination d_syslog_tcp {
             syslog("192.168.1.1" transport("tcp") port(2010)); };
log { source(s_local);destination(d_syslog_tcp); };
source s_network { syslog(ip(10.1.2.3) transport("udp")); };
source s_network { syslog(ip(10.1.2.3) transport("tcp")); };
destination d_local {
    file("/var/log/messages"); };
destination d_local {
    file("/var/log/messages_$HOST"); };
log {
        source(s_local); source(s_network); destination(d_local);
@version: 4.0
@include "scl.conf"
    options { 
        time_reap(30);
        mark_freq(10);
        keep_hostname(yes);
        };
    source s_local { system(); internal(); };
    source s_network { syslog(transport(tcp))};
    destination d_logs { 
        file(
            "/var/log/syslog-ng/logs.txt"
            owner("root")
            group("root")
            perm(0777)
            ); };
    log { source(s_local); source(s_network); destination(d_logs); };
@version: @techversion;
@include "scl.conf"
    options { 
        time_reap(30);
        mark_freq(10);
        keep_hostname(yes);
        chain_hostnames(no);
        };
    source s_local { system(); internal(); };
    source s_network { syslog(transport(tcp))};

    destination d_syslog_tcp {
        syslog("192.168.1.5" transport("tcp") port(2010));
    };
    
    log { source(s_local); source(s_network); 
          destination(d_syslog_tcp); 
        };
@version: 4.1
@version: 4.1

source s_local { unix-stream("/dev/log"); internal(); };

destination d_file {file("/var/log/messages_syslog-ng.log"); };

log { source(s_local); destination(d_file); };
object_type object_id {<options>};
source s_internal { internal(); };
log { source(s_internal); destination(d_file); };
option(parameter1, parameter2); option2(parameter1, parameter2);
source s_tail { file("/var/log/apache/access.log" 
    follow_freq(1) flags(no-parse, validate-utf8)); };
source s_demo_stream1 { 
        unix-stream("/dev/log" max-connections(10) group(log)); };
source s_demo_stream2 { 
        unix-stream("/dev/log" group(log) max-connections(10)); };
options { use_dns(no); };
# Comment: This is a stream source
source s_demo_stream { 
        unix-stream("/dev/log" max-connections(10) group(log)); };
source s_demo_stream { 
        unix-stream("/dev/log" max-connections(10) group(log)); };
source s_demo_stream { 
        unix-stream("/dev/log", max-connections(10), group(log)); };
source "s demo stream" { 
        unix-stream("/dev/log" max-connections(10) group(log)); };
@define name "value"
@define mypath "/opt/myapp/logs"
        source s_myapp_1 { file("`mypath`/access.log" follow_freq(1)); };
        source s_myapp_2 { file("`mypath`/error.log" follow_freq(1)); };
        source s_myapp_3 { file("`mypath`/debug.log" follow_freq(1)); };
@define mypath "/opt/myapp/logs"
        source s_myapp_1 { file("/opt/myapp/logs/access.log" follow_freq(1)); };
        source s_myapp_2 { file("/opt/myapp/logs/error.log" follow_freq(1)); };
        source s_myapp_3 { file("/opt/myapp/logs/debug.log" follow_freq(1)); };
bin/logchksign "cfg-fingerprint='832ef664ff79df8afc66cd955c0c8aaa3c343f31', cfg-nonce-ndx='0', cfg-signature='785223cfa19ad52b855550be141b00306347b0a9'"
@module <module-name>
include "<filename>";
@version: 4.1
include "example.conf";
source s_example {
    include "example.conf"
     };
block type name() {<contents of the block>}
myblock()
block source myappsource() { 
                file("/opt/var/myapplication.log" follow_freq(1) default-facility(syslog)); };
@version: 4.1
include "<correct/path>/myblocks.conf";
source s_myappsource myappsource()
...
log { source(s_myappsource); destination(…); };
block root mylogs() {
        source s_file { file("/var/log/mylogs.log" follow_freq(1)); };
        destination d_local { file("/var/log/messages"); };
        log { source(s_file); destination(d_local); };
        };
block type block_name(argument1(<default-value-of-the-argument>) argument2(<default-value-of-the-argument>) argument3())
source <identifier> { source-driver(params); source-driver(params); ... };
source s_demo_tcp { tcp(ip(10.1.2.3) port(1999)); };
source s_demo_two_drivers { 
           tcp(ip(10.1.2.3) port(1999)); 
           udp(ip(10.1.2.3) port(1999)); };
source headerless_messages { udp(default-facility(syslog) default-priority(emerg)); };
source s_demo { 
           internal(); 
           udp(ip(0.0.0.0) port(514)); 
           unix-stream("/dev/log"); };
internal()
source s_local { internal(); };
Declaration:
            file(filename);
source s_file { file("/var/log/messages"); };
source s_tail { file("/var/log/apache/access.log" 
            follow_freq(1) flags(no-parse)); };
source s_file { file("/var/application/*.log" follow_freq(1));};
309 <38>1 2010-10-19T15:50:45.018203+02:00 server1 localprg 1234 - [timeQuality isSynced="0" tzKnown="0"][file@18372.4 size="184567" pos="1024" name="/var/tmp/msg.txt"] seq: 0000000001, runid: 1287496244, stamp: 2010-10-19T15:50:45 messagetext
source s_dell { udp(port(2000) flags(no-hostname)); };
destination d_file {
                file ("/var/log/messages"
                        template("$ISODATE $HOST $(indent-multi-line $MESSAGE)\n") );
};
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start:
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.net.BindException: Address already in use<null>:8080
       at org.apache.catalina.connector.Connector.start(Connector.java:1138)
       at org.apache.catalina.core.StandardService.start(StandardService.java:531)
       at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
       at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:177)
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
INFO: Server startup in 1206 ms
2010.06.09. 12:45:08 org.apache.coyote.http11.Http11Protocol pause
INFO: Pausing Coyote HTTP/1.1 on http-8080
2010.06.09. 12:45:09 org.apache.catalina.core.StandardService stop
INFO: Stopping service Catalina
source s_file{file("/var/log/tomcat6/catalina.2010-06-09.log" follow_freq(0) multi-line-prefix("[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.") flags(no-parse));};
};
Padding was set, and couldn't read enough bytes
source s_file_subdirectories { file("/var/application/*.log"
                    recursive(yes) 
                    follow_freq(1) 
                    log_fetch_limit(100)
                    );};
Declaration:
            pipe(filename);
source s_pipe { pipe("/dev/pipe" pad_size(2048)); };
source s_dell { udp(port(2000) flags(no-hostname)); };
destination d_file {
                file ("/var/log/messages"
                        template("$ISODATE $HOST $(indent-multi-line $MESSAGE)\n") );
};
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start:
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.net.BindException: Address already in use<null>:8080
       at org.apache.catalina.connector.Connector.start(Connector.java:1138)
       at org.apache.catalina.core.StandardService.start(StandardService.java:531)
       at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
       at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:177)
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
INFO: Server startup in 1206 ms
2010.06.09. 12:45:08 org.apache.coyote.http11.Http11Protocol pause
INFO: Pausing Coyote HTTP/1.1 on http-8080
2010.06.09. 12:45:09 org.apache.catalina.core.StandardService stop
INFO: Stopping service Catalina
source s_file{file("/var/log/tomcat6/catalina.2010-06-09.log" follow_freq(0) multi-line-prefix("[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.") flags(no-parse));};
};
Padding was set, and couldn't read enough bytes
Declaration:
program(filename);
source s_program { program("/etc/init.d/mydaemon"); };
source s_dell { udp(port(2000) flags(no-hostname)); };
destination d_file {
                file ("/var/log/messages"
                        template("$ISODATE $HOST $(indent-multi-line $MESSAGE)\n") );
};
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start:
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.net.BindException: Address already in use<null>:8080
       at org.apache.catalina.connector.Connector.start(Connector.java:1138)
       at org.apache.catalina.core.StandardService.start(StandardService.java:531)
       at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
       at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:177)
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
INFO: Server startup in 1206 ms
2010.06.09. 12:45:08 org.apache.coyote.http11.Http11Protocol pause
INFO: Pausing Coyote HTTP/1.1 on http-8080
2010.06.09. 12:45:09 org.apache.catalina.core.StandardService stop
INFO: Stopping service Catalina
source s_file{file("/var/log/tomcat6/catalina.2010-06-09.log" follow_freq(0) multi-line-prefix("[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.") flags(no-parse));};
};
Padding was set, and couldn't read enough bytes
Declaration:
    sun-streams(name_of_the_streams_device door(filename_of_the_door));
source s_stream { sun-streams("/dev/log" door("/etc/.syslog_door")); };
source s_dell { udp(port(2000) flags(no-hostname)); };
Padding was set, and couldn't read enough bytes
Declaration:
        syslog(ip() port() transport() options());
source s_syslog { syslog(ip(127.0.0.1) port(1999) transport("tcp")); };
source s_udp { syslog( transport("udp")); };
source s_syslog_tls{ syslog(
    ip(10.100.20.40)
    transport("tls")
    tls(
    peer-verify(required-trusted)
    ca_dir('/opt/syslog-ng/etc/syslog-ng/keys/ca.d/')
    key_file('/opt/syslog-ng/etc/syslog-ng/keys/server_privatekey.pem')
    cert_file('/opt/syslog-ng/etc/syslog-ng/keys/server_certificate.pem')
    )
    );};
source s_dell { udp(port(2000) flags(no-hostname)); };
destination d_file {
                file ("/var/log/messages"
                        template("$ISODATE $HOST $(indent-multi-line $MESSAGE)\n") );
};
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start:
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.net.BindException: Address already in use<null>:8080
       at org.apache.catalina.connector.Connector.start(Connector.java:1138)
       at org.apache.catalina.core.StandardService.start(StandardService.java:531)
       at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
       at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:177)
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
INFO: Server startup in 1206 ms
2010.06.09. 12:45:08 org.apache.coyote.http11.Http11Protocol pause
INFO: Pausing Coyote HTTP/1.1 on http-8080
2010.06.09. 12:45:09 org.apache.catalina.core.StandardService stop
INFO: Stopping service Catalina
source s_file{file("/var/log/tomcat6/catalina.2010-06-09.log" follow_freq(0) multi-line-prefix("[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.") flags(no-parse));};
};
Padding was set, and couldn't read enough bytes
unix-dgram("/dev/log");
file("/proc/kmsg" program-override("kernel") flags(kernel));
sun-streams("/dev/log");
sun-streams("/dev/log" door("/etc/.syslog_door"));
sun-streams("/dev/log" door("/var/run/syslog_door"));
unix-dgram("/var/run/log");
unix-dgram("/var/run/logpriv" perm(0600));
file("/dev/klog" follow-freq(0) program-override("kernel") flags(no-parse));
pipe("/dev/log" pad_size(2048));
unix-dgram("/dev/log");
Declaration:
            tcp([options]);
            udp([options]);
source s_udp { udp(); };# An UDP source with default settings.
source s_tcp { tcp(ip(127.0.0.1) port(1999) max-connections(10)); };
source s_tcp { tcp(ip(127.0.0.1) port(1999) 
           tls(peer-verify('required-trusted') 
               key_file('/opt/syslog-ng/etc/syslog-ng/syslog-ng.key') 
           cert_file('/opt/syslog-ng/etc/syslog-ng/syslog-ng.crt'))); 
};
source s_tcp_syslog { tcp(ip(127.0.0.1) port(1999) flags(syslog-protocol) ); };
source s_dell { udp(port(2000) flags(no-hostname)); };
destination d_file {
                file ("/var/log/messages"
                        template("$ISODATE $HOST $(indent-multi-line $MESSAGE)\n") );
};
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start:
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.net.BindException: Address already in use<null>:8080
       at org.apache.catalina.connector.Connector.start(Connector.java:1138)
       at org.apache.catalina.core.StandardService.start(StandardService.java:531)
       at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
       at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:177)
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
INFO: Server startup in 1206 ms
2010.06.09. 12:45:08 org.apache.coyote.http11.Http11Protocol pause
INFO: Pausing Coyote HTTP/1.1 on http-8080
2010.06.09. 12:45:09 org.apache.catalina.core.StandardService stop
INFO: Stopping service Catalina
source s_file{file("/var/log/tomcat6/catalina.2010-06-09.log" follow_freq(0) multi-line-prefix("[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.") flags(no-parse));};
};
Padding was set, and couldn't read enough bytes
Declaration: 
            unix-stream(filename [options]);
            unix-dgram(filename [options]);
source s_stream { unix-stream("/dev/log" max-connections(10)); };
source s_dgram { unix-dgram("/var/run/log"); };
source s_dell { udp(port(2000) flags(no-hostname)); };
destination d_file {
                file ("/var/log/messages"
                        template("$ISODATE $HOST $(indent-multi-line $MESSAGE)\n") );
};
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start:
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.net.BindException: Address already in use<null>:8080
       at org.apache.catalina.connector.Connector.start(Connector.java:1138)
       at org.apache.catalina.core.StandardService.start(StandardService.java:531)
       at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
       at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
       at org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:177)
2010.06.09. 12:07:39 org.apache.catalina.startup.Catalina start
INFO: Server startup in 1206 ms
2010.06.09. 12:45:08 org.apache.coyote.http11.Http11Protocol pause
INFO: Pausing Coyote HTTP/1.1 on http-8080
2010.06.09. 12:45:09 org.apache.catalina.core.StandardService stop
INFO: Stopping service Catalina
source s_file{file("/var/log/tomcat6/catalina.2010-06-09.log" follow_freq(0) multi-line-prefix("[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.") flags(no-parse));};
};
Padding was set, and couldn't read enough bytes
destination <identifier> { 
                destination-driver(params); destination-driver(params); ... };
destination d_demo_tcp { tcp("10.1.2.3" port(1999)); };
destination d_tcp { tcp("target_host" port(1999); localport(999)); };
Declaration:
                file(filename options());
destination d_file { file("/var/log/messages" ); };
destination d_file {
        file("/var/log/$YEAR.$MONTH.$DAY/messages"
             template("$HOUR:$MIN:$SEC $TZ $HOST [$LEVEL] $MSG $MSG\n")
             template_escape(no));
};
Declaration:
                logstore(filename options());
destination d_logstore { logstore("/var/log/messages.lgs" compress(5) ); };
destination d_logstore { logstore("/var/log/messages-logstore.lgs"
    encrypt_certificate("/opt/syslog-ng/etc/syslog-ng/keys/10-100-20-40/public-certificate-of-the-server.pem")			
    owner("balabit")
    group("balabit")
    perm(0777)
); };
options {
        timestamp_url("http://10.50.50.50:8080/");
        timestamp_policy("0.4.0.2023.1.1");
};
Declaration:
	    logstore(filename options());
destination d_logstore { 
                     logstore("/var/log/messages-logstore.lgs"
                     encrypt_certificate 
                      ("/opt/syslog-ng/etc/syslog-ng/keys/public-server-certificate.pem")
                     journal_block_size(524288) journal_block_count(5)); 
};
destination d_logstore { 
                     logstore("/var/log/messages-logstore.lgs"
                     encrypt_certificate 
                      ("/opt/syslog-ng/etc/syslog-ng/keys/public-server-certificate.pem")
                     journal_block_size(524288) journal_block_count(5)); 
};
Declaration:
                pipe(filename);
destination d_pipe { pipe("/dev/xconsole"); };
Declaration: 
                program(command_to_run);
destination d_prog { program("/bin/script" template("<$PRI>$DATE $HOST $MSG\n"); ); };
Declaration:
                @module snmp
                destination d_snmp {snmp(host() trap_obj() snmp_obj() ...);};
@module snmp
destination d_snmpv2c{
    snmp(
        version('v2c')
        host('192.168.1.1')
        trap_obj('.1.3.6.1.6.3.1.1.4.1.0', 'Objectid', '.1.3.6.1.4.1.18372.3.1.1.1.2.1')
        snmp_obj('.1.3.6.1.4.1.18372.3.1.1.1.1.1.0', 'Octetstring', 'Test SNMP trap')
        snmp_obj('.1.3.6.1.4.1.18372.3.1.1.1.1.2.0', 'Octetstring', 'admin')
        snmp_obj('.1.3.6.1.4.1.18372.3.1.1.1.1.3.0', 'Ipaddress', '192.168.1.1')
        );
};
destination d_snmpv3{
    snmp(
        version('v3')
        host('192.168.1.1')
        port(162)
        engine_id('0xdeadbeefde')
        auth_username('myusername')
        auth_password('password')
        enc_algorithm('AES')
        enc_password('password')
        trap_obj('.1.3.6.1.6.3.1.1.4.1.0', 'Objectid', '.1.3.6.1.4.1.18372.3.1.1.1.2.1')
        snmp_obj('.1.3.6.1.4.1.18372.3.1.1.1.1.1', 'Octetstring', '$MESSAGE')
        snmp_obj('.1.3.6.1.4.1.18372.3.1.1.1.1.2', 'Octetstring', 'admin')
        snmp_obj('.1.3.6.1.4.1.18372.3.1.1.1.1.3', 'Ipaddress', '$SOURCEIP')
        );
};
@module snmp
@include "scl.conf"
<patterndb version="4" pub_date="2011-05-03">
  <ruleset name="cisco snmp ruleset1" id="480de478-d4a6-4a7f-bea4-0c0245d361e3">
    <description>Pattern for Cisco messages having BSD timestamps, for example: Jul 01 2010 00:32:59: %SYS-5-CONFIG_I: Configured from console by console</description>
    <url>http://balabit.com</url>
      <pattern>%@ESTRING:.cisco.Facility:-@@ESTRING:.cisco.Severity:-@@ANYSTRING:.cisco.MsgName@</pattern>
        <rules>
          <rule id="09944c71-95eb-4bc0-8575-936931d85713" provider="balabit" class="system">
            <patterns>
              <pattern> @ANYSTRING:.cisco.MsgText@</pattern>
              </patterns>
          </rule>
        </rules>
  </ruleset>
  <ruleset name="cisco snmp ruleset2" id="480de478-d4a6-4a7f-bea4-0c0245d361e3">
    <description>Pattern for Cisco messages having cisco-specific timestamps, for example: 18: Jan 22 10:45:44.543: %SYS-5-CONFIG_I: Configured from console by console</description>
    <url>http://balabit.com</url>
        <rules>
          <rule id="09944c71-95eb-4bc0-8575-936931d85714" provider="balabit" class="system">
            <patterns>
              <pattern>%@ESTRING:.cisco.Facility:-@@ESTRING:.cisco.Severity:-@@ESTRING:.cisco.MsgName::@ @ANYSTRING:.cisco.MsgText@</pattern>
             </patterns>
          </rule>
        </rules>
  </ruleset>
</patterndb>
Declaration:
destination d_cisco_snmp {cisco_snmp(host(<hostname>));};
destination d_cisco_snmp {cisco_snmp(host("192.168.1.1")
    version("v3")
    engine_id("'0xdeadbeefde'")
    auth_username('myusername')
    auth_password('password')
    enc_password('password'));};

snmp_obj('.1.3.6.1.4.1.18372.3.1.1.1.1.3', 'Ipaddress', '192.168.1.1')
snmp_obj('.1.3.6.1.4.1.18372.3.1.1.1.1.2', 'Octetstring', '$MESSAGE')
Declaration: 
    sql(database_type host_parameters database_parameters [options]);
destination d_sql { 
  sql(type(pgsql)
  host("logserver") username("syslog-ng") password("password")
  database("logs")
  table("messages_${HOST}_${R_YEAR}${R_MONTH}${R_DAY}")
  columns("datetime", "host", "program", "pid", "message")
  values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
  indexes("datetime", "host", "program", "pid", "message"));
  };
destination d_sql { 
  sql(type(pgsql)
  host("logserver") username("syslog-ng") password("password")
  database("logs")
  table("messages_${HOST}_${R_YEAR}${R_MONTH}${R_DAY}")
  columns("datetime varchar(16)", "host varchar(32)", "program  varchar(20)", "pid varchar(8)", "message  varchar(200)")
  values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
  indexes("datetime", "host", "program", "pid", "message"));
};
destination d_sql { 
  sql(type(oracle)
  username("syslog-ng") password("password")
  database("LOGS")
  table("msgs_${R_YEAR}${R_MONTH}${R_DAY}")
  columns("datetime varchar(16)", "host varchar(32)", "program varchar(32)", "pid varchar(8)", "message varchar2")                        
  values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
  indexes("datetime", "host", "program", "pid", "message"));
  };
LOGS =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCP)
(HOST = logserver)
(PORT = 1521))
)
(CONNECT_DATA =
(SERVICE_NAME = EXAMPLE.SERVICE)
)
)
destination d_mssql { 
sql(type(mssql) host("logserver") port("1433") 
  username("syslogng") password("syslogng") database("syslogng") 
  table("msgs_${R_YEAR}${R_MONTH}${R_DAY}")columns("datetime varchar(16)", "host varchar(32)",
  "program varchar(32)", "pid varchar(8)", "message varchar(4096)")
  values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
  indexes("datetime", "host", "program", "pid"));
  };
[default]
date = "%Y-%m-%d %H:%M:%S"
destination d_sql { 
                        sql(type(pgsql)
                        host("logserver") username("syslog-ng") password("password")
                        database("logs")
                        table("messages_${HOST}_${R_YEAR}${R_MONTH}${R_DAY}")
                        columns("datetime", "host", "program", "pid", "message")
                        values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
                        indexes("datetime", "host", "program", "pid", "message")
                        null(""));                    
                        };
destination d_sql { 
                        sql(type(pgsql)
                        host("logserver") username("syslog-ng") password("password")
                        database("logs")
                        table("messages_${HOST}_${R_YEAR}${R_MONTH}${R_DAY}")
                        columns("datetime", "host", "program", "pid", "message")
                        values("$R_DATE", "$HOST", "$PROGRAM", "${PID:-@@NULL@@}", "$MSGONLY")
                        indexes("datetime", "host", "program", "pid", "message")
                        null("@@NULL@@"));                    
                        };
columns("date datetime", "host varchar(32)", "row_id serial")
	values("$R_DATE", "$HOST", default)
Declaration:
                syslog(host transport [options]);
destination d_tcp { syslog("10.1.2.3" transport("tcp") port(1999) localport(999)); };
destination d_tcp { syslog("target_host" transport("tcp") port(1999) localport(999)); };
destination d_syslog_tls{ 
                syslog("10.100.20.40"
                transport("tls")
                port(6514)
                tls(peer-verify(required-trusted)
                ca_dir('/opt/syslog-ng/etc/syslog-ng/keys/ca.d/')
                key_file('/opt/syslog-ng/etc/syslog-ng/keys/client_key.pem')
                cert_file('/opt/syslog-ng/etc/syslog-ng/keys/client_certificate.pem'))
                );};
destination d_syslog_tcp{
                syslog("10.100.20.40"
                transport("tcp")
                port(6514)
                failover_servers("10.2.3.4", "myfailoverserver")
                );};
destination d_syslog_tls{
	            syslog("10.100.20.40"
                transport("tls")
                port(6514)
                failover_servers("10.2.3.4", "myfailoverserver")
                tls(peer-verify(required-trusted)
                ca_dir('/opt/syslog-ng/etc/syslog-ng/keys/ca.d/')
                key_file('/opt/syslog-ng/etc/syslog-ng/keys/client_key.pem')
                cert_file('/opt/syslog-ng/etc/syslog-ng/keys/client_certificate.pem'))
                );};
Declaration:
                tcp(host [options]);
                udp(host [options]);
                tcp6(host [options]);
                udp6(host [options]);
destination d_tcp { tcp("10.1.2.3" port(1999) localport(999)); };
destination d_tcp { tcp("target_host" port(1999) localport(999)); };
destination d_tcp { tcp("10.1.2.3" port(1999) flags(syslog-protocol) ); };
tcp6("fd00:abcd:4321:2:20c:29ff:fea8:9671" port(514));
tcp6("fd00:abcd:4321:2:20c:29ff:fea8:9671" port(514));
destination d_tcp { tcp("10.1.2.3" port(1999) failover_servers("10.2.3.4", "third-logserver.example.com"); };
destination d_tcp {
         tcp("10.100.20.40" port(8989)
                 failover_servers("10.2.3.4")
                 tls(peer-verify(required-trusted)
                 ca_dir('/opt/syslog-ng/etc/keys/cas/')
                 key_file('/opt/syslog-ng/etc/keys/client-key.pem')
                 cert_file('/opt/syslog-ng/etc/keys/client-pubcert.pem')));
};
destination d_tcp { 
                    tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); };
Declaration: 
                unix-stream(filename [options]);
                unix-dgram(filename [options]);
destination d_unix_stream { unix-stream("/var/run/logs"); };
Declaration: 
usertty(username);
destination d_usertty { usertty("root"); };
log {
    source(s1); source(s2); ... 
    optional_element(filter1|parser1|rewrite1); optional_element(filter2|parser2|rewrite2);... 
    destination(d1); destination(d2); ... 
    flags(flag1[, flag2...]);
    };
source s_localhost { tcp(ip(127.0.0.1) port(1999) ); };
destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); };
log { source(s_localhost); destination(d_tcp); };
log {
    source(s1); source(s2); ... 
    
    optional_element(filter1|parser1|rewrite1); 
    optional_element(filter2|parser2|rewrite2);... 
    
    destination(d1); destination(d2); ... 
    
    #embedded log statement
    log
        {
        optional_element(filter1|parser1|rewrite1); 
        optional_element(filter2|parser2|rewrite2);
        ... 
        destination(d1); destination(d2); ...
        #another embedded log statement
        log
        {
            optional_element(filter1|parser1|rewrite1); 
            optional_element(filter2|parser2|rewrite2);
            ... 
            destination(d1); destination(d2); ...};
        };    
    #set flags after the embedded log statements
    flags(flag1[, flag2...]); 
        };
log { source(s_localhost); destination(d_file1); destination(d_file2); };
log { source(s_localhost); destination(d_file1); 
                    log {destination(d_file2); };
};
log { source(s_localhost); host(192.168.1.); destination(d_file1); 
                    log {message("example"); destination(d_file2); };
};
log { source(s_localhost); source(s_network); destination(d_file1); 
                    log {source(s_network); destination(d_file2); };
                    };
log { source(s_localhost); destination(d_file); flags(catchall); };
source s_file {file("/tmp/input_file.log");};
destination d_file {file("/tmp/output_file.log");};
destination d_tcp { tcp("127.0.0.1" port(2222) log_fifo_size(1000)); };
log{ source(s_file); destination(d_file); destination(d_tcp);};

source s_file {file("/tmp/input_file.log");};
destination d_file {file("/tmp/output_file.log");};
destination d_tcp { tcp("127.0.0.1" port(2222) log_fifo_size(1000)); };
log{ source(s_file); destination(d_file); destination(d_tcp) flags(flow_control);};

source s_localhost { 
            tcp(ip(127.0.0.1) port(1999) max-connections(300)); };
destination d_tcp { 
            tcp("10.1.2.3" port(1999); localport(999)); log_fifo_size(30000); };
log { source(s_localhost); destination(d_tcp); flags(flow-control); };
source s_localhost { 
            tcp(ip(127.0.0.1) port(1999) max-connections(300)); };
source s_tcp { 
            tcp(ip(192.168.1.5) port(1999) max-connections(100)); };
destination d_tcp { 
            tcp("10.1.2.3" port(1999); localport(999)); log_fifo_size(40000); };
log { source(s_localhost); destination(d_tcp); flags(flow-control); };
destination d_tcp { 
                    tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); };
filter <identifier> { <filter_type>("<filter_expression>"); };
filter demo_filter { host("example"); };
log demo_filteredlog {
        source(s1);
        filter(demo_filter);
        destination(d1);};
filter demo_filter1 { host("example1"); };
filter demo_filter2 { host("example2"); };
log demo_filteredlog {
    source(s1); source(s2); 
    filter(demo_filter1); filter(demo_filter2);
    destination(d1); destination(d2); };
filter demo_filter { host("example1") or host("example2"); };
log demo_filteredlog {
    source(s1); source(s2); 
    filter(demo_filter);
    destination(d1); destination(d2); };
filter demo_filter { not host("example1"); };
filter demo_filter { not host("example1") and not host("example2"); };
filter demo_filter { not (host("example1") or host("example2")); };
filter demo_filter { host("example") and match("deny" value("MESSAGE")); };
filter <filter-id> 
        {"<macro-or-template>" operator "<value-or-macro-or-template>"};
filter f_pid {"$PID" !=""};
filter f_pid {"$HOST$PID" eq "$HOST"};
filter f_level {"$LEVEL_NUM" > "5"};
filter f_wildcard {host("myhost*" type(glob));};
filter f_carriage_return {match("\x0d" value ("MESSAGE"));};
facility(local0..local5)
level(warning)
level(err..emerg)
source s_tcp {
    tcp(ip(192.168.1.1) port(1514) tags("tcp", "router"));
    };
filter f_tcp {
       tags(".source.s_tcp");
    };

    filter f_router {
       tags("router");
    };
filter f_tag_filter {tags(".classifier.system");};
filter demo_debugfilter { level(debug); };
log { source(s_all); filter(demo_debugfilter); flags(final); };
options { option1(params); option2(params); ... };
options { use_dns(no); };
options { 
    logstore_journal_shmem_threshold(33554432); 
};
destination d_messages { logstore("/var/log/messages_logstore.lgs"
                         journal_block_size(19660800)
                         journal_block_count(5)
                         ); 
};
destination demo_tls_destination {
                tcp("10.1.2.3" port(6514) 
                    tls( ca_dir("/opt/syslog-ng/etc/syslog-ng/ca.d")) ); };
destination demo_tls_syslog_destination { syslog("10.1.2.3" port(6514)
                        transport("tls")
                        port(3214)
                        tls(ca_dir("/opt/syslog-ng/etc/syslog-ng/ca.d")) ); 
};
source demo_tls_source {
           tcp(ip(0.0.0.0) port(1999) 
               tls( key_file("/opt/syslog-ng/etc/syslog-ng/key.d/syslog-ng.key") 
                    cert_file("/opt/syslog-ng/etc/syslog-ng/cert.d/syslog-ng.cert")) ); };
source demo_tls_syslog_source {                    
                    syslog(ip(0.0.0.0) port(1999)
                    transport("tls")
                    tls( key_file("/opt/syslog-ng/etc/syslog-ng/key.d/syslog-ng.key") 
                    cert_file("/opt/syslog-ng/etc/syslog-ng/cert.d/syslog-ng.cert")) ); };
source demo_tls_source {
           tcp(ip(0.0.0.0) port(1999) 
               tls( key_file("/opt/syslog-ng/etc/syslog-ng/key.d/syslog-ng.key") 
                    cert_file("/opt/syslog-ng/etc/syslog-ng/cert.d/syslog-ng.cert") 
                    peer_verify(optional-untrusted))  ); };
source demo_tls_syslog_source {                    
                        syslog(ip(0.0.0.0) port(1999)
                        transport("tls")
                        tls( key_file("/opt/syslog-ng/etc/syslog-ng/key.d/syslog-ng.key") 
                        cert_file("/opt/syslog-ng/etc/syslog-ng/cert.d/syslog-ng.cert") 
                        peer_verify(optional-untrusted))  ); };
destination demo_tls_destination {
    tcp("10.1.2.3" port(1999) 
        tls( ca_dir("/opt/syslog-ng/etc/syslog-ng/ca.d") 
             key_file("/opt/syslog-ng/etc/syslog-ng/key.d/client.key")
             cert_file("/opt/syslog-ng/etc/syslog-ng/cert.d/client_cert.pem")) ); };
destination demo_tls_syslog_destination {
    syslog("10.1.2.3" port(1999) 
        transport("tls")
            tls( ca_dir("/opt/syslog-ng/etc/syslog-ng/ca.d")
                 key_file("/opt/syslog-ng/etc/syslog-ng/key.d/client.key")
                 cert_file("/opt/syslog-ng/etc/syslog-ng/cert.d/client_cert.pem")) ); };
source demo_tls_source {
           tcp(ip(0.0.0.0) port(1999) 
               tls( key_file("/opt/syslog-ng/etc/syslog-ng/key.d/syslog-ng.key") 
                    cert_file("/opt/syslog-ng/etc/syslog-ng/cert.d/syslog-ng.cert") 
                    ca_dir("/opt/syslog-ng/etc/syslog-ng/ca.d")) ); };
source demo_tls_syslog_source {                    
                        syslog(ip(0.0.0.0) port(1999)
                        transport("tls")
                        tls( key_file("/opt/syslog-ng/etc/syslog-ng/key.d/syslog-ng.key")
                        cert_file("/opt/syslog-ng/etc/syslog-ng/cert.d/syslog-ng.cert") 
                        ca_dir("/opt/syslog-ng/etc/syslog-ng/ca.d")) ); };
${HOST:-default_hostname}
template t_demo_filetemplate { 
             template("$ISODATE $HOST $MSG\n"); template_escape(no); };          
destination d_file { 
             file("/var/log/messages" template(t_demo_filetemplate)); };
destination d_file {
                file ("/var/log/messages"
                        template("$ISODATE $HOST $MSG\n") template_escape(no) ); 
                };
            
destination d_file {
        file("/var/log/$YEAR.$MONTH.$DAY/$HOST.log");
};
$(function-name parameter1 parameter2 parameter3 ...)
$(echo "$HOST $PROGRAM $PID")
$(echo $(echo $HOST))
$(echo argument)
$(grep condition value-to-select)
$(grep ("${username}" == "root") ${auth_method})
$(if (<condition>) <true template> <false template>)
$(if ("${username}" == "root") "violation" "system")
<value name="username">$(if ("${username}" == "root") "violation" "system")</value>
<value name="username">
        $(if ("${username}" == "root") 
            "root" 
            $(if ("${username}" == "joe") "admin" "normal user") 
            "normal user")</value>
$(ipv4-to-int parameter)
$(<operator> <first_operand> <second_operand>)
$(* $FACILITY_NUM 8)
$(+ $LEVEL_NUM $(* $FACILITY_NUM 8))
Declaration:
    rewrite <name_of_the_rule> 
            {
            subst("<string or regular expression to find>", 
                "<replacement string>", value(<field name>), flags()
                );
            };
rewrite r_rewrite_subst{subst("IP", "IP-Address", value("MESSAGE"));};
rewrite r_rewrite_subst{subst("IP", "IP-Address", value("MESSAGE"), flags("global"));};
rewrite r_rewrite_subst{subst("IP", "IP-Address", value("MESSAGE")); subst("Address", "Addresses", value("MESSAGE"));};
Declaration:
            rewrite <name_of_the_rule>
                {set("<string to include>", value(<field name>));};
rewrite r_rewrite_set{set("myhost", value("HOST"));};
rewrite r_sd { set("55555" value(".SDATA.meta.sequenceId")); };
rewrite r_rewrite_set{set("yes", value("MODIFIED"));};
rewrite r_rewrite_set{set("myhost", value("HOST") condition(program("myapplication")));};
filter f_rewritefilter {program("myapplication");};
rewrite r_rewrite_set{set("myhost", value("HOST") condition(filter(f_rewritefilter)));};
filter demo_regexp_insensitive { host("system" flags(ignore-case)); };
filter f_message { message("keyword" flags("utf8" "ignore-case") );
rewrite r_rewrite_subst 
        {subst("a*", "?", value("MESSAGE") type("pcre") flags("utf8" "global"));  };
xntpd[1567]: time error -1159.777379 is too large (set clock manually);
filter f_demo_regexp {
    program("demo_program") and
    match("time error .* is too large .* set clock manually"); };
filter f_demo_optimized_regexp {
    program("demo_program") and
    match("time error") and 
    match("is too large") and 
    match("set clock manually"); };
Declaration:
            parser parser_name {
            csv-parser(column1, column2, ...)
            delimiters()
            quote-pairs()
            };
parser p_hostname_segmentation {
    csv-parser(columns("HOSTNAME.NAME", "HOSTNAME.ID")
    delimiters("-")
    flags(escape-none)
    template("${HOST}"));
};
destination d_file { file("/var/log/messages-${HOSTNAME.NAME:-examplehost}"); };
log { source(s_local); parser(p_hostname_segmentation); destination(d_file);};
"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %T %v"
192.168.1.1 - - [31/Dec/2007:00:17:10 +0100] "GET /cgi-bin/example.cgi HTTP/1.1" 200 2708 "-" "curl/7.15.5 (i4 86-pc-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8c zlib/1.2.3 libidn/0.6.5" 2 example.balabit
parser p_apache {
    csv-parser(columns("APACHE.CLIENT_IP", "APACHE.IDENT_NAME", "APACHE.USER_NAME",
        "APACHE.TIMESTAMP", "APACHE.REQUEST_URL", "APACHE.REQUEST_STATUS",
        "APACHE.CONTENT_LENGTH", "APACHE.REFERER", "APACHE.USER_AGENT",
        "APACHE.PROCESS_TIME", "APACHE.SERVER_NAME")
         flags(escape-double-char,strip-whitespace)
         delimiters(" ")
         quote-pairs('""[]')
         );
};
log { source(s_local);
    parser(p_apache); destination(d_file);};
};
destination d_file { file("/var/log/messages-${APACHE.USER_NAME:-nouser}"); };
parser p_apache_timestamp {
    csv-parser(columns("APACHE.TIMESTAMP.DAY", "APACHE.TIMESTAMP.MONTH", "APACHE.TIMESTAMP.YEAR", "APACHE.TIMESTAMP.HOUR", "APACHE.TIMESTAMP.MIN", "APACHE.TIMESTAMP.MIN", "APACHE.TIMESTAMP.ZONE")
    delimiters("/: ")
    flags(escape-none)
    template("${APACHE.TIMESTAMP}"));
    };
log { source(s_local);
    log { parser(p_apache); parser(p_apache_timestamp); destination(d_file);};
};

Declaration:
    parser parser_name {
        csv-parser(column1, column2, ...)
        delimiters()
        quote-pairs()
    };
csv_parser(columns("COLUMN1", "COLUMN2", "COLUMN3") delimiters(","));
csv_parser(columns("COLUMN1", "COLUMN2", "COLUMN3") delimiters(",") flags(greedy));
Declaration:
        parser <identifier> {db_parser(file("<database_filename>"));};
parser pattern_db {
            db_parser(
                file("/opt/syslog-ng/var/db/patterndb.xml")
            );
            };
log { 
        source(s_all);
        parser(pattern_db);            
        destination( di_messages_class);
        };
destination di_messages_class {
        file("/var/log/messages-${.classifier.class}"
        template("${.classifier.rule_id};${S_UNIXTIME};${SOURCEIP};${HOST};${PROGRAM};${PID};${MSG}\n")
        template_escape(no)
    );
};
filter fi_class_violation {
                    match("violation"
                    value(".classifier.class")
                    type("string")
                    );
                    };
log { 
                    source(s_all);
                    parser(pattern_db);
                    filter(fi_class_violation);
                    destination(di_class_violation);
                    };
filter fi_class_rule {
                    match("e1e9c0d8-13bb-11de-8293-000c2922ed0a"
                    value(".classifier.rule_id")
                    type("string")
                    );
                    };
filter f_tag_filter {tags(".classifier.system");};
'Transaction: @ESTRING::.@'
'Transaction: @ESTRING:TRANSACTIONTYPE:.@'
match("accepted" value("TRANSACTIONTYPE"));
<38>1990-01-01T14:45:25 customhostname program6[1234]: program6 testmessage
<38>1990-01-01T14:46:25 customhostname program6[1234]: program6 testmessage
<rule id="..." context-id="ssh-session" context-timeout="86400" context-scope="process">
    <patterns>
        <pattern>Accepted @ESTRING:usracct.authmethod: @for @ESTRING:usracct.username: @from @ESTRING:usracct.device: @port @ESTRING:: @@ANYSTRING:usracct.service@</pattern>
    </patterns>
...
</rule>
parser p_db {db_parser(
    file("mypatterndbfile.xml")
    inject_mode(internal)
);}; 
parser p_db {db_parser(
    file("mypatterndbfile.xml")
    inject_mode(pass-through)
);}; 
<actions>
    <action>
        <message>
            <values>
                <value name="MESSAGE">A log message from $HOST matched rule number $.classifier.rule_id</value>
            </values>
        </message>
    </action>
</actions>
<action condition="'${HOST}' == 'example'">
<actions> 
    <action>
        <message>
            <values>
                <value name="MESSAGE">An SSH session for ${SSH_USERNAME}@1 from ${SSH_CLIENT_ADDRESS}@2 closed. Session lasted from ${DATE}@2 $DATE </value>
            </values>
        </message>
    </action>
</actions>
<values>
    <value name="MESSAGE">A log message from $HOST matched rule number $.classifier.rule_id</value>
    <value name="TRIGGER">yes</value>
</values>
destination d_triggers { program("/bin/myscript"; ); };
filter f_triggers {match("yes" value ("TRIGGER") type(string));};
log { source(s_local); filter(f_triggers); destination(d_triggers); };
#!/usr/bin/perl
while (<>) {
        # body of the script to send emails, snmp traps, and so on
}
<action trigger="timeout">
@STRING@
@STRING:myparser_name@
@STRING:myparser_name:*@
@STRING::*@
<patterndb version='4' pub_date='2010-10-25'>
<ruleset name='su' id='480de478-d4a6-4a7f-bea4-0c0245d361e1'>
<patterns>
    <pattern>su</pattern>
<patterns>
<patterns>
    <pattern>firstapplication</pattern>
    <pattern>otherapplication</pattern>
<patterns>
<rule provider='balabit' id='f57196aa-75fd-11dd-9bba-001e6806451b' class='violation'>
<rule provider='balabit' id='f57196aa-75fd-11dd-9bba-001e6806451b' class='violation' context-id='same-session' context-scope='process' context-timeout='360'>
<pattern>+ ??? root-</pattern>
<value name=".classifier.outcome">/Success</value>
<test_message program="myapplication">Content filter has been enabled</test_message>
<test_message program="proftpd">ubuntu (::ffff:192.168.2.179[::ffff:192.168.2.179]) - FTP session closed.</test_message>
<test_value name=".dict.ContentFilter">enabled</test_value>
<value name="MESSAGE">A log message matched rule number $.classifier.rule_id</value>
<tags><tag>UserLogin</tag></tags>
Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2
<patterndb version='4' pub_date='2010-10-17'>
    <ruleset name='ssh' id='123456678'>
        <pattern>ssh</pattern>
            <rules>
                <rule provider='me' id='182437592347598' class='system'>
                    <patterns>
                        <pattern>Accepted @QSTRING:SSH.AUTH_METHOD: @ for@QSTRING:SSH_USERNAME: @from\ @QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
                    </patterns>
                </rule>
            </rules>
    </ruleset>
</patterndb>
<patterndb version='4' pub_date='2010-10-17'>
    <ruleset name='ssh' id='123456678'>
        <pattern>ssh</pattern>
            <rules>
                <rule provider='me' id='182437592347598' class='system'>
                    <patterns>
                        <pattern>Accepted @QSTRING:SSH.AUTH_METHOD: @ for@QSTRING:SSH_USERNAME: @from\ @QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
                    </patterns>
                    <examples>
                        <example>
                            <test_message>Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2</test_message>
                            <test_values>
                                <test_value name="SSH.AUTH_METHOD">password</test_value>
                                <test_value name="SSH_USERNAME">sampleuser</test_value>
                                <test_value name="SSH_CLIENT_ADDRESS">10.50.0.247</test_value>
                                <test_value name="SSH_PORT_NUMBER">42156</test_value>
                            </test_values>
                       </example>
                    </examples>
                </rule>
            </rules>
    </ruleset>
</patterndb>
Log statistics;
        dropped='tcp(AF_INET(192.168.10.1:514))=6439',
        processed='center(received)=234413',
        processed='destination(d_tcp)=234413',
        processed='destination(d_local)=234413',
        processed='source(s_local)=234413'
src.internal;s_all#0;;a;processed;6445
src.internal;s_all#0;;a;stamp;1268989330
destination;df_auth;;a;processed;404
destination;df_news_dot_notice;;a;processed;0
destination;df_news_dot_err;;a;processed;0
destination;d_ssb;;a;processed;7128
destination;df_uucp;;a;processed;0
source;s_all;;a;processed;7128
destination;df_mail;;a;processed;0
destination;df_user;;a;processed;1
destination;df_daemon;;a;processed;1
destination;df_debug;;a;processed;15
destination;df_messages;;a;processed;54
destination;dp_xconsole;;a;processed;671
dst.tcp;d_network#0;10.50.0.111:514;a;dropped;5080
dst.tcp;d_network#0;10.50.0.111:514;a;processed;7128
dst.tcp;d_network#0;10.50.0.111:514;a;stored;2048
destination;df_syslog;;a;processed;6724
destination;df_facility_dot_warn;;a;processed;0
destination;df_news_dot_crit;;a;processed;0
destination;df_lpr;;a;processed;0
destination;du_all;;a;processed;0
destination;df_facility_dot_info;;a;processed;0
center;;received;a;processed;0
destination;df_kern;;a;processed;70
center;;queued;a;processed;0
destination;df_facility_dot_err;;a;processed;0
options {threaded(yes) ; };
source s_tcp_syslog { tcp(ip(127.0.0.1) port(1999) flags("syslog-protocol", "threaded") ); };
ulimit -c unlimited
options {ts_format(iso) ; };
options { dns_cache(2000); };
options { dns_cache_expire(87600); };
options { 
        use_dns(persist_only);
        dns_cache_hosts(/etc/hosts); };
./dqtool cat ../var/syslog-ng-00000.qf
Disk-buffer state loaded; filename='../var/syslog-ng-00000.qf', qout_length='65', qbacklog_length='0', qoverflow_length='9205', qdisk_length='0'
Mar  3 10:52:05 tristram localprg[1234]: seq: 0000011630, runid: 1267609923, stamp: 2010-03-03T10:52:05 PADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADD
Mar  3 10:52:05 tristram localprg[1234]: seq: 0000011631, runid: 1267609923, stamp: 2010-03-03T10:52:05 PADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADD
lgstool cat --key=mykey.pem mylogstore.lgs
lgstool inspect --key=mykey.pem mylogstore.lgs
XFRM_INFO @941
    cipher: aes-128-cbc
    digest: sha1
CHUNK 0@1079: [1 - 1000]:
    encrypt: TRUE
    compress: TRUE
    hmac: TRUE
    chunk_mac: e4d5d813979cf865d5ae4624f7aa98047123cd52
    file_mac: 6600600ca5befb002a73b15be8f0ac04973d5936
TIMESTAMP @36481:
    chunk_id: 0
    Status info:
    Status: Granted.
    Status description: unspecified
    Failure info: unspecified
    TST info:
    Version: 1
    Policy OID: 1.2.3.4
    Hash Algorithm: sha1
    Message data:
        0000 - 66 00 60 0c a5 be fb 00-2a 73 b1 5b e8 f0 ac 04 f.`.....*s.[....
        0010 - 97 3d 59 36                                       .=Y6
    Serial number: 0x029A
    Time stamp: Mar 19 13:48:57 2010 GMT
    Accuracy: 0x01 seconds, 0x01F4 millis, 0x64 micros
    Ordering: no
    Nonce: 0xB613F55AEFFA6DC0
    TSA: unspecified
    Extensions:
lgstool recover mylogstore.lgs
lgstool tail -f -n=20 --key=mykey.pem mylogstore.lgs
lgstool validate --key=mykey.pem --ca-file=mycacert.pem --ts-name=MYTSA mylogstore.lgs
pdbtool dump -p patterndb.xml  -P 'sshd'
'p'
   'assword for'
     @QSTRING:@
       'from'
        @QSTRING:@
          'port '
            @NUMBER:@ rule_id='fc49054e-75fd-11dd-9bba-001e6806451b'
              ' ssh' rule_id='fc55cf86-75fd-11dd-9bba-001e6806451b'
                 '2' rule_id='fc4b7982-75fd-11dd-9bba-001e6806451b'
    'ublickey for'
      @QSTRING:@
        'from'
         @QSTRING:@
           'port '
             @NUMBER:@ rule_id='fc4d377c-75fd-11dd-9bba-001e6806451b'
               ' ssh' rule_id='fc5441ac-75fd-11dd-9bba-001e6806451b'
                  '2' rule_id='fc44a9fe-75fd-11dd-9bba-001e6806451b'
              
pdbtool match -p patterndb.xml -P sshd -M "Accepted publickey for myuser from 127.0.0.1 port 59357 ssh2"
pdbtool match -p sshd.pdb \
  –file /var/log/messages \
  –filter ‘tags(“usracct”);’ 
pdbtool merge --recursive --directory /home/me/mypatterns/  --pdb /var/lib/syslog-ng/patterndb.xml
pdbtool patternize --support=2.5 --file=/var/log/messages
pdbtool test --validate /home/me/mypatterndb.pdb
object_type object_id {<options>};
source s_internal { internal(); };
log { source(s_internal); destination(d_file); };
option(parameter1, parameter2); option2(parameter1, parameter2);
source s_tail { file("/var/log/apache/access.log" 
    follow_freq(1) flags(no-parse, validate-utf8)); };
source s_demo_stream1 { 
        unix-stream("/dev/log" max-connections(10) group(log)); };
source s_demo_stream2 { 
        unix-stream("/dev/log" group(log) max-connections(10)); };
options { use_dns(no); };
# Comment: This is a stream source
source s_demo_stream { 
        unix-stream("/dev/log" max-connections(10) group(log)); };
log {
    source(s1); source(s2); ... 
    optional_element(filter1|parser1|rewrite1); optional_element(filter2|parser2|rewrite2);... 
    destination(d1); destination(d2); ... 
    flags(flag1[, flag2...]);
    };
source s_localhost { tcp(ip(127.0.0.1) port(1999) ); };
destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); };
log { source(s_localhost); destination(d_tcp); };
options { option1(params); option2(params); ... };
syslog-ng-ctl verbose --set=on
syslog-ng-ctl stats
src.internal;s_all#0;;a;processed;6445
src.internal;s_all#0;;a;stamp;1268989330
destination;df_auth;;a;processed;404
destination;df_news_dot_notice;;a;processed;0
destination;df_news_dot_err;;a;processed;0
destination;d_ssb;;a;processed;7128
destination;df_uucp;;a;processed;0
source;s_all;;a;processed;7128
destination;df_mail;;a;processed;0
destination;df_user;;a;processed;1
destination;df_daemon;;a;processed;1
destination;df_debug;;a;processed;15
destination;df_messages;;a;processed;54
destination;dp_xconsole;;a;processed;671
dst.tcp;d_network#0;10.50.0.111:514;a;dropped;5080
dst.tcp;d_network#0;10.50.0.111:514;a;processed;7128
dst.tcp;d_network#0;10.50.0.111:514;a;stored;2048
destination;df_syslog;;a;processed;6724
destination;df_facility_dot_warn;;a;processed;0
destination;df_news_dot_crit;;a;processed;0
destination;df_lpr;;a;processed;0
destination;du_all;;a;processed;0
destination;df_facility_dot_info;;a;processed;0
center;;received;a;processed;0
destination;df_kern;;a;processed;70
center;;queued;a;processed;0
destination;df_facility_dot_err;;a;processed;0

	x86	x86_64	SUN SPARC	SUN SPARC64	ppc32	ppc64	PA-RISC	IA64	ALPHA
AIX 5.2 & 5.3	X	X	X	X	✔	-	X	X	X
AIX 6.1	X	X	X	X	✔	-	X	X	X
Debian sarge	X	✔	X	X	X	X	X	X	X
Debian etch	✔	✔	X	X	X	X	X	X	X
Debian lenny	✔	✔	X	X	X	X	X	X	X
Debian squeeze	✔	✔	X	X	X	X	X	X	X
FreeBSD 6.1	✔	-	-	X	X	X	X	X	X
FreeBSD 7.1	✔	✔	-	X	X	X	X	X	X
FreeBSD 8.0	✔	✔	-	X	X	X	X	X	X
HP-UX 11i	X	X	X	X	X	X	✔	X	X
HP-UX 11v2	X	X	X	X	X	X	X	✔	X
IBM System i	X	X	X	X	✔	X	X	X	X
openSUSE 10.0	✔	-	X	X	X	X	X	X	X
openSUSE 10.1	✔	✔	X	X	X	X	X	X	X
openSUSE 11.0	✔	✔	X	X	X	X	X	X	X
Red Hat Enterprise Linux 2	✔	X	X	X	X	X	X	X	X
Red Hat Enterprise Linux 3	✔	✔	X	X	X	X	X	X	X
Red Hat ES 4	✔	✔	X	X	X	X	X	X	X
Red Hat ES 5	✔	✔	X	X	X	X	X	X	X
Red Hat ES 6	✔	✔	X	X	X	X	X	X	X
SLES 10	✔	-	X	X	X	X	X	X	X
SLES 10 SP1	✔	✔	X	X	X	X	X	X	X
SLES 11.0	✔	✔	X	X	X	X	X	X	X
Solaris 8	X	X	✔	✔	X	X	X	X	X
Solaris 9	✔	X	✔	✔	X	X	X	X	X
Solaris 10	-	✔	✔	✔	X	X	X	X	X
Tru64	X	X	X	X	X	X	X	X	✔
Ubuntu 8.04 (Hardy Heron)	✔	✔	X	X	X	X	X	X	X
Ubuntu 10.04 (Lucid Lynx)	✔	✔	X	X	X	X	X	X	X
Windows	✔	✔	X	X	X	X	X	X	X

Numerical Code	Facility
0	kernel messages
1	user-level messages
2	mail system
3	system daemons
4	security/authorization messages
5	messages generated internally by syslogd
6	line printer subsystem
7	network news subsystem
8	UUCP subsystem
9	clock daemon
10	security/authorization messages
11	FTP daemon
12	NTP subsystem
13	log audit
14	log alert
15	clock daemon
16-23	locally used facilities (local0-local7)

Numerical Code	Severity
0	Emergency: system is unusable
1	Alert: action must be taken immediately
2	Critical: critical conditions
3	Error: error conditions
4	Warning: warning conditions
5	Notice: normal but significant condition
6	Informational: informational messages
7	Debug: debug-level messages

Numerical Code	Facility
0	kernel messages
1	user-level messages
2	mail system
3	system daemons
4	security/authorization messages
5	messages generated internally by syslogd
6	line printer subsystem
7	network news subsystem
8	UUCP subsystem
9	clock daemon
10	security/authorization messages
11	FTP daemon
12	NTP subsystem
13	log audit
14	log alert
15	clock daemon
16-23	locally used facilities (local0-local7)

Numerical Code	Severity
0	Emergency: system is unusable
1	Alert: action must be taken immediately
2	Critical: critical conditions
3	Error: error conditions
4	Warning: warning conditions
5	Notice: normal but significant condition
6	Informational: informational messages
7	Debug: debug-level messages

	Note
	Notes provide additional information on a topic, and emphasize important facts and considerations.

	Warning
	Warnings mark situations where loss of data or misconfiguration of the device is possible if the instructions are not obeyed.

	Warning
	Message filtering, parsing, and rewriting is performed in the order that the operations appear in the log statement.

	Note
	The syslog-ng client sends a message to all matching destinations by default. As a result, a message may be sent to a destination more than once, if the destination is used in multiple log statements. To prevent such situations, use the `final` flag in the destination statements. For details, see Table 8.1, Log statement flags.

	Note
	The syslog-ng application can stop reading messages from its sources if the destinations cannot process the sent messages. This feature is called flow-control and is detailed in Section 8.2, Managing incoming and outgoing messages with flow-control.

	Note
	Microsoft Windows based hosts can run only the syslog-ng Agent for Windows application. The syslog-ng Agent for Windows application operates only in client mode.

	Note
	A message can be sent to multiple destination zones. The syslog-ng application converts the timezone information properly for every individual destination zone.

	Warning
	If syslog-ng PE sends the message is to the destination using the legacy-syslog protocol (RFC3164) which does not support timezone information in its timestamps, the timezone information cannot be encapsulated into the sent timestamp, so syslog-ng PE will convert the hour:min values based on the explicitly specified timezone.

	Warning
	Downgrading from a feature release to an earlier (and thus unsupported) feature release, or to the previous LTS release is officially not supported, but usually works as long as your syslog-ng PE configuration file is appropriate for the old syslog-ng PE version. However, persistent data like the position of the last processed message in a file source will be probably lost.

	Note
	The syslog-ng application supports longer messages as well. For details, see the `log_msg_size()` option in Section 9.2, Global options. However, it is not recommended to enable messages larger than the packet size when using UDP destinations.

	Note
	Facility codes may slightly vary between different platforms. The syslog-ng application accepts facility codes as numerical values as well.

	Note
	Facility codes may slightly vary between different platforms. The syslog-ng application accepts facility codes as numerical values as well.

	Tip
	For the list of hard and soft macros, see Section 11.1.3, Hard vs. soft macros.

	Note
	The native logrotation tools do not send a SIGHUP to syslog-ng after rotating the log files, causing syslog-ng to write into files already rotated. To solve this problem, the syslog-ng init script links the `/var/run/syslog.pid` file to syslog-ng's pid. Also, on Linux, the `install.sh` script symlinks the initscript of the original syslog daemon to syslog-ng's initscript.

	Note
	The syslog-ng application supports other timestamp formats as well, like ISO, or the PIX extended format. For details, see the `ts_format()` option in Section 9.2, Global options.

	Tip
	In case you need to relay messages that cannot be parsed without any modifications or changes, use the `flags(no-parse)` option in the source definition, and a template containing only the `$MSG` macro in the destination definition.

	Note
	There are two versions of every binary release. The one with the `client` suffix does not include the libraries required to log into SQL databases. If you are installing syslog-ng in client or relay mode, or you do not use the `sql()` destination, use these binaries. That way no unnecessary components are installed to your system.

	Note
	The installer stops the running syslogd application if it is running, but its components are not removed. The `/etc/init.d/sysklogd` init script is automatically renamed to `/etc/init.d/sysklogd.backup`. Rename this file to its original name if you want to remove syslog-ng or restart the syslogd package.

	Note
	Accepting remote messages and forwarding them to a logserver means that syslog-ng will start in relay mode.

	Warning
	The `--` characters between the executable and the parameters are mandatory, like in the following example: ./syslog-ng-premium-edition-3.0.1b-solaris-10-sparc-client.run -- --accept-eula -l /var/tmp/license.txt

	Note
	If you are upgrading from syslog-ng version 2.1, note that the location of the configuration file has been moved to `/opt/syslog-ng/etc/syslog-ng.conf`

	Warning
	Hazard of data loss! Installing rpm package syslog-ng PE on AIX platform is possible even if the upgrade conditions are not met, since the rpm package installs before checking the upgrade conditions and therefore no error message is displayed. This might result in overwriting the old configuration file.

	Warning
	Incorrect language settings may result in the database converting the messages to a different character-encoding format. That way the log messages may become unreadable, causing information loss.

	Tip
	Many applications send log messages to logfiles by default (for example, the Roundcube webmail client, or the ProFTPD FTP server), but can be configured to send them to syslog instead. If possible, it is recommended to reconfigure the application that way.

The syslog-ng Premium Edition 4 F1 Administrator Guide

Preface

Preface

1. Summary of contents

2. Target audience and prerequisites

3. Products covered in this guide

4. Typographical conventions

5. Contact and support information

5.1. Sales contact

5.2. Support contact

5.3. Training

6. About this document

6.1. Summary of changes

6.1.1. Version 4.0 - 4 F1

6.2. Feedback

6.3. Acknowledgments

Chapter 1. Introduction to syslog-ng

1.1. What syslog-ng is

1.2. What syslog-ng is not

1.3. Why is syslog-ng needed?

1.4. What is new in syslog-ng Premium Edition 4 F1?

1.5. Who uses syslog-ng?

1.6. Supported platforms

1.6.1. Certified packages

Chapter 2. The concepts of syslog-ng

2.1. The philosophy of syslog-ng

2.2. Logging with syslog-ng

2.3. Modes of operation

2.3.1. Client mode

2.3.2. Relay mode

2.3.3. Server mode

2.4. Global objects

2.5. Timezones and daylight saving

2.5.1. A note on timezones and timestamps

2.6. Versions and releases of syslog-ng PE

2.7. Licensing

2.8. High availability support

2.9. The structure of a log message

2.9.1. BSD-syslog or legacy-syslog messages

2.9.1.1. The PRI message part

2.9.1.2. The HEADER message part

2.9.1.3. The MSG message part

2.9.2. IETF-syslog messages

2.9.2.1. The PRI message part

2.9.2.2. The HEADER message part

2.9.2.3. The STRUCTURED-DATA message part

2.9.2.4. The MSG message part

2.9.3. Message representation in syslog-ng PE

Chapter 3. Installing syslog-ng

3.1. Prerequisites to installing syslog-ng PE

HP-UX

IBM AIX

3.2. Installing syslog-ng using the .run installer

3.2.3. Installing syslog-ng without user-interaction

3.5. Upgrading syslog-ng PE

3.5.1. Upgrading syslog-ng PE to other package versions

3.5.2. Uprading from previous syslog-ng PE versions

3.5.3. Upgrading from previous syslog-ng OSE versions

3.5.4. Upgrading from syslog-ng PE to syslog-ng OSE

3.5.5. Upgrading from complete syslog-ng PE to client setup version of syslog-ng PE

3.6. Uninstalling syslog-ng PE

Chapter 4. The syslog-ng PE quick-start guide

4.3. Configuring syslog-ng relays

4.3.2. How relaying log messages works

Chapter 5. The syslog-ng PE configuration file

5.1. The syslog-ng configuration file

5.1.1. The configuration syntax in detail

5.1.2. Notes about the configuration syntax

5.2. Global and environmental variables

5.3. Logging configuration changes

5.4. Modules and plugins in syslog-ng PE

5.4.1. Loading modules

5.5. Managing complex syslog-ng configurations

5.5.1. Including configuration files

5.5.2. Reusing configuration blocks

5.5.2.1. Passing arguments to configuration blocks

Chapter 6. Collecting log messages — sources and source drivers

6.1. How sources work

6.2. Collecting internal messages

6.3. Collecting messages from text files

	Note
	Starting with syslog-ng PE version 3.2, the `syslog()` source driver can handle both BSD-syslog (RFC 3164) and IETF-syslog (RFC 5424-28) messages.

	Note
	By default, the syslog-ng server will treat the relayed messages as if they were created by the relay host, not the host that originally sent them to the relay. In order to use the original hostname on the syslog-ng server, use the `keep_hostname(yes)` option both on the syslog-ng relay and the syslog-ng server. This option can be set individually for every source if needed.

	Note
	It is recommended to use these options on your syslog-ng PE server as well.

	Note
	It is also possible to resolve IP addresses locally, without relying on the DNS server. For details on local name resolution, see Procedure 17.3.1, Resolving hostnames locally.

	Note
	Earlier versions of syslog-ng PE stored the configuration and license files under different directories, depending on the platform; typically under `/etc/syslog-ng/`.

	Note
	On Microsoft Windows platforms the syslog-ng Agent for Windows stores its configuration in the system registry or in an XML file, and can be configured from a graphical interface. For details, see The syslog-ng Agent for Windows 4.0 Administrator Guide.

	`Syslog-ng's config file format was written by programmers for programmers to be understood by programmers. That may not have been the stated intent, but it is how things turned out. The syntax is exactly that of C, all the way down to braces and statement terminators.`
	--Alan McKinnon

	Tip
	Use identifiers that refer to the type of the object they identify. For example, prefix source objects with `s_`, destinations with `d_`, and so on.

	Tip
	The environmental variables of the host are automatically imported and can be used as global variables.

	Note
	Modular configuration files that are included in the main configuration file of syslog-ng PE are included when the fingerprint is calculated. However, other external files (for example, scripts used in program sources or destinations) are excluded, therefore their modifications do not change the fingerprint.