# Define a new log file for daemon facility
daemon.*                           /var/log/daemon.log

$ sudo /sbin/service syslog restart
Shutting down kernel logger:                               [  OK  ]
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]

$ logger -p daemon.notice "This is a notice"

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*							/dev/console

# Define a new log file for daemon facility
daemon.*                                               /var/log/daemon.log

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;news.none;authpriv.none;cron.none		/var/log/messages

# The authpriv file has restricted access.
authpriv.*						/var/log/secure

# Log all the mail messages in one place.
mail.*							-/var/log/maillog


# Log cron stuff
cron.*							/var/log/cron

# Everybody gets emergency messages
*.emerg							*

# Save news errors of level crit and higher in a special file.
uucp,news.crit						/var/log/spooler

# Save boot messages also to boot.log
local7.*						/var/log/boot.log

#
# INN
#
news.=crit                                        /var/log/news/news.crit
news.=err                                         /var/log/news/news.err
news.notice                                       /var/log/news/news.notice

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

openvpn.net/howto.html#mitm for more info.
Nov 21 14:42:13 localhost openvpn[1964]: Re-using SSL/TLS context
Nov 21 14:42:13 localhost openvpn[1964]: LZO compression initialized
Nov 21 14:42:13 localhost openvpn[1964]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Nov 21 14:42:13 localhost openvpn[1964]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Nov 21 14:42:13 localhost openvpn[1964]: Local Options hash (VER=V4): '41690919'
Nov 21 14:42:13 localhost openvpn[1964]: Expected Remote Options hash (VER=V4): '530fdded'
Nov 21 14:42:13 localhost openvpn[1964]: Socket Buffers: R=[110592->131072] S=[110592->131072]
Nov 21 14:42:13 localhost openvpn[1964]: UDPv4 link local: [undef]
Nov 21 14:42:13 localhost openvpn[1964]: UDPv4 link remote: 192.168.1.3:1194
Nov 21 14:42:13 localhost openvpn[1964]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

$ less /var/log/messages

$ tail -f /var/log/messages

# grep '[Mm]ouse' /var/log/messages
Dec  8 00:15:28 smp kernel: Detected PS/2 Mouse Port.
Dec  8 10:55:02 smp gpm: Shutting down gpm mouse services:

# grep 'sendmail:' /var/log/messages*

# /sbin/service iptables restart
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: filter                    [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules:                          [  OK  ]
Loading additional iptables modules: ip_conntrack_netbios_n[  OK  ]ntrack_ftp

*.debug                                       @192.168.1.3
*.debug                                       /var/log/messages

$ sudo /sbin/service syslog restart
Password:
Shutting down kernel logger:                               [  OK  ]
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]

$ sudo /sbin/service openvpn stop
Shutting down openvpn:                                     [  OK  ]

# tail /var/log/messages
...
...
Dec  1 21:31:13 192.168.1.2 localhost openvpn[4507]: TCP/UDP: Closing socket
Dec  1 21:31:13 192.168.1.2 localhost openvpn[4507]: SIGTERM[hard,] received, process exiting
...
...

# Save boot messages also to boot.log
 local7.*						/var/log/boot.log

# Save all authorization messages to auth.log
 auth,authpriv.*			/var/log/auth.log

# Log anything (except mail, news, authpriv, cron) of level info or higher.
 # Don't log private authentication messages!
 *.info;mail.none;news.none;authpriv.none;cron.none		/var/log/messages

 # Lưu tập trung các thông tin của /var/log/messages về server syslog.mycompany.com
 *.info;mail.none;news.none;authpriv.none;cron.none		@syslog.mycompany.com

 # Save all authorization messages to auth.log
 auth,authpriv.*			/var/log/auth.log

 # Lưu tất cả các authorization message về syslog server
 auth,authpriv.*			@syslog.mycompany.com

# wget http://www.balabit.com/downloads/files/eventlog/0.2/eventlog-0.2.5.tar.gz
--21:43:01--  http://www.balabit.com/downloads/files/eventlog/0.2/eventlog-0.2.5.tar.gz
Resolving www.balabit.com... 212.92.18.33
Connecting to www.balabit.com|212.92.18.33|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]
Saving to: `eventlog-0.2.5.tar.gz'

    [                 <=>                    ] 312,164     35.3K/s   in 8.6s   

21:43:29 (35.3 KB/s) - `eventlog-0.2.5.tar.gz' saved [312164]

# wget http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/syslog-ng-2.0.6.tar.gz
--21:46:37--  http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/syslog-ng-2.0.6.tar.gz
Resolving www.balabit.com... 212.92.18.33
Connecting to www.balabit.com|212.92.18.33|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]
Saving to: `syslog-ng-2.0.6.tar.gz'

    [                                  <=>   ] 369,302     15.2K/s   in 21s    

21:47:00 (17.0 KB/s) - `syslog-ng-2.0.6.tar.gz' saved [369302]

$ yum -y install glib

# tar -zxvf eventlog-0.2.5.tar.gz
# cd eventlog-0.2.5
# ./configure
# make
# make install

# export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/

# tar -zxvf syslog-ng-2.0.6.tar.gz
# cd syslog-ng-2.0.6
# ./configure --sysconfdir=/etc
# make
# make install

[root@localhost syslog-ng-2.0.6]# ls contrib
aix-packaging      init.d.solaris  Makefile.in         syslog-ng.conf.HP-UX
fedora-packaging   init.d.SunOS    README              syslog-ng.conf.RedHat
hpux-packaging     init.d.SuSE     relogger.pl         syslog-ng.conf.SunOS
init.d.HP-UX       lfs-packaging   rhel-packaging      syslog-ng.vim
init.d.RedHat      Makefile        syslog2ng
init.d.RedHat-7.3  Makefile.am     syslog-ng.conf.doc

# mkdir /etc/syslog-ng
# cp contrib/fedora-packaging/syslog-ng.init /etc/init.d/syslog-ng
# cp contrib/fedora-packaging/syslog-ng.conf /etc/syslog-ng
# cp contrib/fedora-packaging/syslog-ng.sysconfig /etc/sysconfig/syslog-ng
# cp contrib/fedora-packaging/syslog-ng.logrotate /etc/logrotate.d/syslog-ng

# chmod 755 /etc/init.d/syslog-ng

# updatedb
# locate syslog-ng | grep bin
/usr/local/sbin/syslog-ng
# vi /etc/init.d/syslog-ng
...
#exec="/sbin/syslog-ng"
exec="/usr/local/sbin/syslog-ng"
...

# service syslog stop
# service syslog-ng start

# groupadd logs
# usermod -G logs quanta

# chkconfig syslog off
# chkconfig syslog-ng on

# syslog-ng configuration file.
#
# This should behave pretty much like the original syslog on RedHat. But
# it could be configured a lot smarter.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
# ...
#

options {
    sync (0);
    time_reopen (10);
    log_fifo_size (1000);
    use_dns (no);
    use_fqdn (no);
    create_dirs (yes);
    keep_hostname (yes);
};

source s_sys {
    file ("/proc/kmsg" log_prefix("kernel: "));
    unix-stream ("/dev/log");
    internal();
    # udp(ip(0.0.0.0) port(514));
    # tcp(ip(0.0.0.0) port(514));
};

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog" sync(10)); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_mlal { usertty("*"); };

#filter f_filter1   { facility(kern); };
filter f_filter2   { level(info..emerg) and
                     not facility(mail,authpriv,cron); };
filter f_filter3   { facility(authpriv); };
filter f_filter4   { facility(mail); };
filter f_filter5   { level(emerg); };
filter f_filter6   { facility(uucp) or
                     (facility(news) and level(crit..emerg)); };
filter f_filter7   { facility(local7); };
filter f_filter8   { facility(cron); };

#log { source(s_sys); filter(f_filter1); destination(d_cons); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_auth); };
log { source(s_sys); filter(f_filter4); destination(d_mail); };
log { source(s_sys); filter(f_filter5); destination(d_mlal); };
log { source(s_sys); filter(f_filter6); destination(d_spol); };
log { source(s_sys); filter(f_filter7); destination(d_boot); };
log { source(s_sys); filter(f_filter8); destination(d_cron); };

# vim:set ai ts=4 sw=4 sts=4 et:

options {
    sync (0);
    time_reopen (10);
    log_fifo_size (1000);
    use_dns (no);
    use_fqdn (no);
    create_dirs (yes);
    keep_hostname (yes);
};

log { source(s_sys); filter(f_filter2); destination(d_mesg); };

source s_remote { tcp(); };
destination d_clients { file("/var/log/HOSTS/$HOST/"); };
log { source(s_remote); destination(d_clients); };

#sample syslog-ng.conf for a remote client
source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); };
destination d_loghost {tcp("192.168.1.2" port(514));};
log { source(s_local); destination(d_loghost); };

# /etc/init.d/syslog-ng restart

# logger "this is a test"
# logger -p auth.debug "this is a test"

destination d_auth_log { file("/var/log/auth.log"); };

 filter f_filter9   { facility(auth) or facility(authpriv); };
 
 log { source(s_sys); filter(f_filter9); destination(d_auth_log); };

/usr/local/sbin/syslog-ng -s /etc/syslog-ng.conf
/etc/init.d/syslog-ng reload

libsyslog-ng.a(logsource.o): In function `log_source_init_instance':
/root/setupsyslog/syslog-ng-2.0.6/src/logsource.c:58: undefined reference to `g_assertion_message_expr'
collect2: ld returned 1 exit status
make[2]: *** [syslog-ng] Error 1
make[2]: Leaving directory `/root/setupsyslog/syslog-ng-2.0.6/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/root/setupsyslog/syslog-ng-2.0.6'
make: *** [all] Error 2

Name        : syslog-ng
Version     : 3.2.5
Release     : 1.el6
Architecture: x86_64
Size        : 1582418
Packager    : Fedora Project
Group       : System Environment/Daemons
URL         : http://www.balabit.com/network-security/syslog-ng
Repository  : epel
Summary     : Next-generation syslog server
Description :
syslog-ng, as the name shows, is a syslogd replacement, but with new
functionality for the new generation. The original syslogd allows
messages only to be sorted based on priority/facility pairs; syslog-ng
adds the possibility to filter based on message contents using regular
expressions. The new configuration scheme is intuitive and powerful.
Forwarding logs over TCP and remembering all forwarding hops makes it
ideal for firewalled environments.