Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Syslog-ng

|

433

As you can see in this example, all messages from the host 192.168.190.190 are writ-

ten to the logfile /var/log/micklog, as are all local mail messages. Messages that match

the

f_messages( ) filter are written to the logfile /var/log/messages.$WEEKDAY—e.g.,

/var/log/messages.Sun, /var/log/messages.Mon, etc.

Example 12-19 isn’t very realistic, though: no nonmail messages with priority-level

higher than warn are dealt with. This raises the question, “Can I get syslog-ng to fil-

ter on ‘none of the above’?” The answer is yes: to match all messages that haven’t yet

matched filters in previous

log{} statements, you can use the built-in filter

DEFAULT. The following line, if added to the bottom of Example 12-18, causes all

messages not processed by any of the prior three

log{} statements to be written to

the daily logfile:

log { source(s_loc); filter(DEFAULT); destination(d_dailylog); };

Syslog-ng 1.6 log{} statements now also support the flags( ) option. If a log state-

ment ends with

flags("final"), log processing ceases with that statement.

flags("fallback") causes the log statement to match only if the message being evalu-

ated didn’t match any previous

log{} statements. And flags("catchall") causes the

log{} statement’s souce( ) definitions to be ignored—only its filter( )