Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

422

|

Chapter 12: System Log Management and Monitoring

startup flags by editing the file /etc/sysconfig/syslog and setting the value of the vari-

able

SYSLOG_NG_PARAMS.

Configuring Syslog-ng

There’s quite a bit more involved in configuring Syslog-ng than with syslog, but

that’s an outcome of its flexibility. Once you understand how syslog-ng.conf works,

writing your own configurations is simple, and adapting sample configurations for

your own purposes is even simpler. Its main drawback is its haphazard documenta-

tion; hopefully, what follows here will mitigate that drawback for you.

By default, Syslog-ng’s configuration file is named syslog-ng.conf and resides in /etc/

syslog-ng/. Let’s dissect a simple example of one in Example 12-12.

As you can see, a syslog-ng.conf file consists of

options{}, source{}, destination{},

filter{},andlog{} statements. Each statement may contain additional settings, usu-

ally delimited by semicolons.

Syntactically, syslog-ng.conf is very similar to C and other structured programming

languages. Statements are terminated by semicolons; whitespace is ignored and may

therefore be used to enhance readability (e.g., by breaking up and indenting lengthy

statements across several lines).

After defining global options, message sources, message destinations, and message ...