Syslog-ng

options {
	chain_hostnames(0);
	time_reopen(10);
	time_reap(360);
	log_fifo_size(2048);
	create_dirs(yes);
	group(admin);
	perm(0640);
	dir_perm(0755);
	use_dns(no);

#	keep_timestamp("no");
};

## Sources ##

source s_all {
	internal();
	unix-stream("/dev/log");
	file("/proc/kmsg" log_prefix("kernel: "));
	udp();
};

## Filters ##

filter f_windows {
  	program(MSWinEventLog);
};

filter f_cisco_asa {
	match("%ASA-");
};

filter f_cisco_sec {
        match("%SEC-");
};

filter f_cisco_pix {
        match("%PIX-");
};

filter f_not_cisco_asa {
        not match("%ASA-");
};

filter f_not_cisco_sec {
        not match("%SEC-");
};

filter f_not_cisco_pix {
        not match("%PIX-");
};

filter f_not_windows {
	not program(MSWinEventLog);
};

#### Security Filters

filter f_vlocke_check {match([oO][hH][vV][lL][lL]1);};

## Destinations ##

destination d_windows {
	pipe("/var/log/buffers/windows"
        template("$R_ISODATE $HOST [$FACILITY.$LEVEL] $MSG\n")
        template_escape(no)
	);
};

destination d_cisco {
	pipe("/var/log/buffers/cisco"
        template("$R_ISODATE $HOST [$FACILITY.$LEVEL] $MSG\n")
        template_escape(no)
	);
};

destination d_pix {
        pipe("/var/log/buffers/pix"
        template("$R_ISODATE $HOST [$FACILITY.$LEVEL] $MSG\n")
        template_escape(no)
	);
};

destination d_gen_fifo {
	pipe("/var/log/buffers/syslog"
	template("$R_ISODATE $HOST [$FACILITY.$LEVEL] $MSG\n")
        template_escape(no)
)	;
};

destination d_all {
	file("/var/log/syslog/archive-$R_YEAR-$R_MONTH-$R_DAY.log"
	owner(nobody)
	group(nobody)
	perm(0644)
	dir_perm(0755)
	create_dirs(yes)
	template("$R_ISODATE $HOST [$FACILITY.$LEVEL] $MSG\n")
	template_escape(no)
	);
};

destination d_arcsight {
        udp("10.208.87.20" port(514));
};

#### Security Checks

destination d_vlocke_check { file("/var/log/security/vlocke-security-check.log"); };

## Logging ##

# Windows Log
log { 
	source(s_all); 
	filter(f_windows);
	destination(d_windows);
};

# Cisco ASA Logs
log {
	source(s_all);
	filter(f_cisco_asa);
	destination(d_cisco);
};

# Cisco SEC Logs
log {
        source(s_all);
        filter(f_cisco_sec);
        destination(d_cisco);
};

# Cisco PIX Logs
log {
        source(s_all);
        filter(f_cisco_pix);
        destination(d_pix);
};

# General FIFO
log { 
	source(s_all); 
	filter(f_not_windows);
	filter(f_not_cisco_asa);
	filter(f_not_cisco_sec);
	filter(f_not_cisco_pix);
	destination(d_gen_fifo);
};

# Arcsight
log {
        source(s_all);
        destination(d_arcsight);
};

# Archive
log { 
	source(s_all); 
	destination(d_all);
};

#### Security Checks

log { source(s_all); filter(f_vlocke_check); destination(d_vlocke_check); };