linux-root/metalog.conf at master · sigaev/linux-root · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
# Sample Metalog configuration file

maxsize  = 1048576  # size in bytes (1048576 = 1 megabyte)
maxtime  = 86400    # time in seconds (86400 = 1 day)
maxfiles = 30       # num files per directory

# This will capture all of the internal log messages that metalog itself
# generates.  If you use any "command" options below, you will want this
# as metalog generates a lot of status messages whenever it executes a
# command and children processes exit.
Metalog :

  program   = "metalog"
  logdir    = "/var/log/metalog"
  break     = 1

# Uncomment and adjust the following lines according to your console logging
# needs.  If you want to only output things that were not caught by other log
# sections, move this to the end of the file.  Make sure this command is on
# your root partition if you have /usr mounted separately.  This script should
# merely write $@ to some device (your console for messages):
# echo "$@" > /dev/tty10
#
# Hint: you can control the consolelog.sh behavior in /etc/conf.d/metalog
#
console logging :

  facility  = "*"
  command   = "/sbin/consolelog.sh"

Everything important :

    facility = "*"
    minimum  = 6
    logdir   = "/var/log/everything"
#if break keyword does not appear, rules after here will be run.

Everything very important :

    facility = "*"
    minimum  = 1
    logdir   = "/var/log/critical"

Password failures :

    regex    = "(password|login|authentication)\s+(fail|invalid)"
    regex    = "(failed|invalid)\s+(password|login|authentication|user)"
    regex    = "ILLEGAL ROOT LOGIN"
    logdir   = "/var/log/pwdfail"
#    command  = "/usr/local/sbin/mail_pwd_failures.sh"

Kernel messages :

    facility = "kern"
    logdir   = "/var/log/kernel"
    break    = 1

Crond :

    facility = "cron"
    logdir   = "/var/log/cron"
    break    = 1

Dudes firewalled by IPTrap :

    program  = "iptrap"
    logdir   = "/var/log/iptrap"
    break    = 1

FTP Server :

    facility = "ftp"
    logdir   = "/var/log/ftpd"
    break    = 1

News Server :

    facility = "news"
    logdir   = "/var/log/news"
    break    = 1

SSH Server :

    program  = "sshd"
    logdir   = "/var/log/sshd"
    break    = 1

#why the hell do you still run that thing !?
Telnet :

    program  = "login"
    logdir   = "/var/log/telnet"
    break    = 1

Imap :

    program  = "/usr/sbin/imapd"
    logdir   = "/var/log/imap"
    break    = 1

POP Toaster :

    program  = "/usr/sbin/ipop3d"
    logdir   = "/var/log/pop"
    break    = 1

# Add authenticated IP addresses for SMTP relaying :

#    program  = "/usr/sbin/ipop3d"
#    regex    = "Login.+nmsgs="
#    command  = "/usr/local/sbin/add_pop_address.sh"
#    break    = 1

Mail :

    facility = "mail"
    neg_regex= "starting daemon"
    logdir   = "/var/log/mail"
    break    = 1

# exim stuff - log output from every program whose name begins with
# "exim".
#
Exim :

    program_regex = "^exim"
    logdir        = "/var/log/exim"
    break         = 1

Ppp :
    program_regex = "^ppp"
    logdir    = "/var/log/ppp"
    break     = 1

Postgresql :
    program_regex = "^postmaster"
    program_regex = "^postgres"
    logdir    = "/var/log/postgres"
    break     = 1

Apache :
    program_regex = "^httpd"
    logdir    = "/var/log/http"
    break     = 1

HAL :
    program_regex = "^hal"
    logdir    = "/var/log/hal"
    break     = 1