options {
   chain_hostnames(0);
   keep_hostname(yes); 
   long_hostnames(off);
   dns_cache(on);
   dns_cache_size(512);
   dns_cache_expire(3600);
   sync(0);
   create_dirs(1); 
   owner("root");
   group("claralogs");
   dir_owner("root");
   dir_group("claralogs");
   dir_perm(0750);
   perm(0740);
};

source src_net { udp(); };
source src_local { unix-dgram("/dev/log"); internal(); };

### FILTRES 
# ACCOUNTING
filter f_accounting { program("^accounting"); };
# CAUTH
filter f_cauth { program("^cauth"); };
filter f_mail { facility(mail); };
# IMAP
filter f_imap { program("imaplogin"); };
# CPOP
filter f_cpop { program("^pop"); };
# CPOP-NG
filter f_cpop_popper { program("^cpop-popper"); };
filter f_cpop_auth { program("^cpop-auth"); };
# CCAM (Claranet Courier Authentication Module)
filter f_ccam { program("^ccam"); };
# NAMED
filter f_named { program("^named"); };
# RADIUS
filter f_radius { program("^radius"); };
# SNORT 
filter f_snort { program("^snort"); };
# FTP
filter f_ftpxfer { program("pure-ftp:"); };
filter f_ftp { program("ftp"); };
#filter f_ftpxfer { program("ftp"); };

# check syslog
filter f_check_syslog { program("^check_syslog"); };

### DESTINATIONS
destination d_local_syslog { file("/var/log/syslog"); };

destination d_accounting { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/accounting.log"); };
destination d_cauth { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/cauth.log"); };
destination d_mail { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/mail.log"); };
destination d_imap { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/imap.log"); };
destination d_cpop { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/cpop.log"); };
destination d_cpop_ng { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/cpop-ng.log"); };
destination d_ccam { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/ccam.log"); };
destination d_named { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/named.log"); };
destination d_radius { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/radius.log"); };
destination d_snort  { file("/mydata/logs/snort/$YEAR/$MONTH/$DAY/$HOST.log"); };
destination d_ftp { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/ftp-easybiz.log"); };
destination d_ftpxfer { file("/mydata/logs/syslog/$HOST/$YEAR/$MONTH/$DAY/xfer-easybiz.log"); };

destination d_check_syslog { file("/var/log/check_syslog.log"); };

#destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); };

# log {   source(s_all); destination(d_mysql); };

### LOGS
log { source(src_local); destination(d_local_syslog); };

log { source(src_net); filter(f_accounting); destination(d_accounting); };
log { source(src_net); filter(f_cauth); destination(d_cauth); };
log { source(src_net); filter(f_mail); destination(d_mail); };
log { source(src_net); filter(f_imap); destination(d_imap); };
log { source(src_net); filter(f_cpop); destination(d_cpop); };
log { source(src_net); filter(f_cpop_popper); destination(d_cpop_ng); };
log { source(src_net); filter(f_cpop_auth); destination(d_cpop_ng); };
log { source(src_net); filter(f_ccam); destination(d_ccam); };
log { source(src_net); filter(f_named); destination(d_named); };
log { source(src_net); filter(f_radius); destination(d_radius); };
log { source(src_net); filter(f_ftp); destination(d_ftp); };
log { source(src_net); filter(f_ftpxfer); destination(d_ftpxfer); };
log { source(src_net); filter(f_snort); destination(d_snort); };

log { source(src_net); filter(f_check_syslog); destination(d_check_syslog); };

#log { source(src_net); destination(d_mysql); };
