Syslog-ng 3.6.4 configuration

syslog-ng.conf

@version:3.6
@include "scl.conf"

options {
    flush-timeout(2000);
    chain-hostnames(no);
    use-dns(yes);
    use-fqdn(no);
    create-dirs(yes);
    keep-hostname(yes);
    frac-digits(3);
    time-reap(3);
    time-reopen(2);
    log-fifo-size(8192000);
    log-msg-size(2097152);
    mark-mode(none);
    stats-level(1);
    stats-freq(0);
    suppress(0);
};

# syslog relay

filter emergency { level(emerg); };

source self_syslog {
    file("/proc/kmsg" program-override("kernel") flags(kernel));
    unix-dgram("/dev/log" keep-timestamp(no));
    internal();
};

destination syslog_log { file("/var/log/syslog/$HOST/$FACILITY/$YEAR$MONTH$DAY-$FACILITY.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); };
destination console { usertty("root"); };
destination syslog_host-siteb { syslog('1.2.6.1' transport(tcp) port(1514)); };

log { source(self_syslog); filter(emergency); destination(console); };
log { source(self_syslog); destination(syslog_log); destination(syslog_host-siteb); };

# gelf relay

filter no_host { "${host}" eq "" };
filter no_timestamp { "${timestamp}" eq "" };

block source self-gelf-channel() {
  channel {
    source {
      network(ip(127.0.0.1) transport(udp) port(12201) flags(no-parse, validate-utf8) log-iw-size(51200) log-fetch-limit(100));
      unix-stream("/var/run/gelf.sock" flags(no-parse, validate-utf8) log-iw-size(51200) log-fetch-limit(100));
    };
    parser { json-parser(); };
    rewrite {
      set("host-sitea", value("host"));
      set("${UNIXTIME}", value("timestamp") condition(filter(no_timestamp)));
    };
    flags(final);
  };
};

template t_relay_gelf { template("$(format-json --pair version='1.1' --key host --pair timestamp=double(${timestamp}) --pair level=int(${level:-1}) --key short_message --key full_message --key _*)$(literal '\0')"); };
template t_self_gelf { template("$(format-json --key host --pair timestamp=double(${timestamp}) --pair level=int(${level:-1}) --key short_message --key full_message --key _*)\n"); };

source self_gelf { self-gelf-channel(); };

destination gelf_log { file("/var/log/syslog/$host/gelf/$YEAR$MONTH$DAY-gelf.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template(t_self_gelf)); };
destination gelf_host-siteb { network('1.2.6.1' transport(tcp) port(12201) template(t_relay_gelf)); };

log { source(self_gelf); destination(gelf_log); destination(gelf_host-siteb); };

# syslog server

filter xen_xapi { program('xapi'); };
filter xen_xenstored { program('xenstored'); };
filter for_sec { not (level(debug) or facility(local6) or facility(local3) or filter(xen_xapi) or filter(xen_xenstored) or program("RT_FLOW")); };
filter syslog_relay { not program('RT_FLOW'); };

block source remote-gelf-channel() {
    channel {
        source {
            network(ip("1.1.6.1") transport(tcp) port(12201) flags(no-parse) so_rcvbuf(8388608) max-connections(512) log-iw-size(512000) log-fetch-limit(2000));
        };
        parser { json-parser(); };
        rewrite {
            set("${HOST}", value("host"));
            set("${UNIXTIME}", value("timestamp") condition(filter(no_timestamp)));
        };
        flags(final);
    };
};

source remote_syslog {
    syslog(ip("1.1.6.1") transport(udp) port(514) so_rcvbuf(8388608) log-iw-size(512000) log-fetch-limit(2000));
    syslog(ip("1.1.6.1") transport(tcp) port(1514) max-connections(512) so_rcvbuf(8388608) log-iw-size(512000) log-fetch-limit(2000));
};
source remote_gelf {
    remote-gelf-channel();
};

destination sec { program('/usr/bin/sec --input=- --debug=4 --intevents --log /var/log/syslog/sec.log --conf /etc/sec/\*.rules --quoting'); };

log { source(remote_syslog); destination(syslog_log); };
log { source(remote_gelf); destination(gelf_log); };
log { source(self_syslog); source(remote_syslog); filter(for_sec); destination(sec); };

# relay to graylog

destination graylog_syslog_sitea { syslog('1.1.6.3' transport(tcp) port(1514)); };
destination graylog_gelf_sitea { network('1.1.6.3' transport(tcp) port(12201) template(t_relay_gelf)); };

log { source(self_syslog); source(remote_syslog); filter(syslog_relay); destination(graylog_syslog_sitea); };
log { source(self_gelf); source(remote_gelf); destination(graylog_gelf_sitea); };