rsyslog_complex.conf

##########
# Global #
##########
# This config isn't necessarily designed for production - it exists to explore features.

# preserve sending host fqdn
$PreserveFQDN on
$CreateDirs on

# Lets log about our queue usage.
module(
	load="impstats"
	interval="10"
	log.file="/var/log/rsyslog_stats.log"
	log.syslog="off"
)
 
#Receive outside syslog
# Provides TCP syslog reception
module(load="imtcp" MaxSessions="5000")
module(load="imudp")

################
# Destinations #
################

template(name="d_catch_all" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%.log")

# Network
template(name="d_network" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%.log")

# *nix
template(name="d_cron" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-cron.log")
template(name="d_kern" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-kernel.log")
template(name="d_mail" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-mail.log")
template(name="d_secure" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-auth.log")
template(name="d_puppet" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-puppet.log")
template(name="d_dhcpd" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-dhcpd.log")
template(name="d_named" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-named.log")
template(name="d_unix_other" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-unix_other.log")

# Cisco
template(name="d_acs" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-cisco_acs.log")
template(name="d_pix" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-asa_pix.log")
template(name="d_asa" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-cisco_asa.log")
template(name="d_cisco" type="string" string="/var/log/remote_syslog/%FROMHOST%/%$YEAR-%$MONTH%-%$DAY%-cisco.log")


###########
# Filters #
###########

# Lets setup a queue
ruleset(name="f_all" queue.type="LinkedList" queue.workerthreads="4" queue.size="100000") {
	# f_network_devices
	if ($fromhost-ip startswith '192.168.100.' or
		$fromhost-ip startswith '192.168.101.' or
		$fromhost-ip startswith '192.168.102.') then {
		call r_network
		stop
	}

	# f_cron
	if ($syslogtag startswith 'cron') then {
		call r_cron
		stop
	}

	# f_kern
	if ($syslogtag startswith 'kern') then {
		call r_kern
		stop
	}

	# f_mail
	if ($syslogtag startswith 'mail' or
		$syslogtag startswith 'sendmail' or
		$syslogtag startswith 'sm-mta' or
		$syslogtag startswith 'postfix' or
		$syslogtag startswith 'sSMTP'
	   ) then {
		call r_mail
		stop
	}

	# f_secure
	if ($syslogtag startswith 'sudo' or
		$syslogtag startswith 'su' or
		$syslogtag startswith 'dzdo' or
		$syslogtag startswith 'adclient' or
		$syslogtag startswith 'runmappers' or
		$syslogtag startswith 'ssh' or
		$syslogtag startswith 'passwd' or
		$syslogtag startswith 'auth' or
		$syslogtag startswith 'security' or
		$syslogtag startswith 'login' or
		$syslogtag startswith 'unix_chkpwd' or
		$syslogtag startswith 'chage'
	   ) then {
		call r_secure
		stop
	}

	# f_puppet
	if ($syslogtag startswith 'puppet') then {
		call r_puppet
		stop
	}

	# f_dhcpd
	if ($syslogtag startswith 'dhcpd') then {
		call r_dhcpd
		stop
	}

	# f_named
	if ($syslogtag startswith 'named') then {
		call r_named
		stop
	}

	# Cisco
	## acs
	if ($syslogtag contains 'CisACS' or $msg contains 'CisACS') then {
		call r_acs
		stop
	}
	## pix
	if ($syslogtag contains 'PIX-' or $msg contains 'PIX-') then {
		call r_pix
		stop
	}
	## asa
	if ($syslogtag contains 'ASA-' or $msg contains 'ASA-') then {
		call r_asa
		stop
	}
	## cisco
	if ($msg contains '%SEC-' or 
		$msg contains '%OSPF-' or
		$msg contains '%LINK-' or
		$msg contains '%SW_MATM-' or
		$msg contains '%IP-' or
		$msg contains '%IP_SNMP-' or
		$msg contains '%C4K_L2MAN-' or
		$msg contains '%CLEAR-' or
		$msg contains "%STACKMGR-" or 
		$msg contains "%EVENT-" or 
		$msg contains "%EC-" or 
		$msg contains "%HA_EM-" or 
		$msg contains "%NAC-" or 
		$msg contains "%GENERAL" or 
		$msg contains "%SNMP-" or 
		$msg contains "%CDP-" or 
		$msg contains "%ISDN-" or 
		$msg contains "%FAN-" or 
		$msg contains "%LINE-" or 
		$msg contains "%SPANTREE-" or 
		$msg contains "%PM-" or 
		$msg contains "%SSH-" or 
		$msg contains "%LINEPROTO-" or 
		$msg contains "%RTD-" or 
		$msg contains "%SYS-" or
		$msg contains "srw-recnet" or 
		$msg contains "efo-recnet" or 
		$msg contains "elw-recnet" or 
		$msg contains "sre-recnet" or 
		$msg contains "uca-recnet"
	   ) then {
		call r_cisco
		stop
	}

	call r_catch_all
	stop
}

############
# rulesets #
############

# Network
ruleset(name="r_network"){
	action(type="omfile" DynaFile="d_network")
}

# *nix
ruleset(name="r_cron"){
	action(type="omfile" DynaFile="d_cron")
}
ruleset(name="r_kern"){
	action(type="omfile" DynaFile="d_kern")
}
ruleset(name="r_mail"){
	action(type="omfile" DynaFile="d_mail")
}
ruleset(name="r_secure"){
	action(type="omfile" DynaFile="d_secure")
}
ruleset(name="r_puppet"){
	action(type="omfile" DynaFile="d_puppet")
}
ruleset(name="r_dhcpd"){
	action(type="omfile" DynaFile="d_dhcpd")
}
ruleset(name="r_named"){
	action(type="omfile" DynaFile="d_named")
}
ruleset(name="r_unix_other"){
	action(type="omfile" DynaFile="d_unix_other")
}

# Cisco
ruleset(name="r_acs"){
	action(type="omfile" DynaFile="d_acs")
}
ruleset(name="r_pix"){
	action(type="omfile" DynaFile="d_pix")
}
ruleset(name="r_asa"){
	action(type="omfile" DynaFile="d_asa")
}
ruleset(name="r_cisco"){
	action(type="omfile" DynaFile="d_cisco")
}

# catch_all
ruleset(name="r_catch_all"){
	action(type="omfile" DynaFile="d_catch_all")
}

###########
# Sources #
###########

input(type="imtcp" port="514" ruleset="f_all")
input(type="imudp" port="514" ruleset="f_all")

input(type="imtcp" port="1540" ruleset="f_all")
input(type="imudp" port="1540" ruleset="f_all")