Modified syslog config

diff --git a/config/syslog-ng/syslog-ng.conf b/config/syslog-ng/syslog-ng.conf
index 3e7c3cfe48c551eb86f15034d4cb07c9dd44c42b..e3cca3d3f7a9cac6c8f757f58b7b5cbc6275d8df 100644 (file)
--- a/config/syslog-ng/syslog-ng.conf
+++ b/config/syslog-ng/syslog-ng.conf
@@ -30,6 +30,10 @@ destination messages { file("/var/log/messages"); };
 destination console { usertty("root"); };
 destination console_all { file("/dev/tty12"); };
 
+destination ids {program("/usr/local/sbin/blocker.pl"); );
+
+#destination loghost { tcp("10.0.0.1" port(514)); };
+
 filter f_auth { facility(auth); };
 filter f_authpriv { facility(auth, authpriv); };
 filter f_syslog { not facility(authpriv, mail) and not match(ppp.*LCP); };
@@ -52,6 +56,9 @@ filter f_warn { level(warn); };
 filter f_crit { level(crit); };
 filter f_err { level(err); };
 
+filter f_ids { facility(auth) and match("snort") and match("Priority: 1"); };
+filter f_ssh { program("sshd.*") and match("(Failed password for root from)") };
+
 log { source(src); filter(f_authpriv); destination(authlog); };
 log { source(src); filter(f_syslog); destination(syslog); };
 log { source(src); filter(f_cron); destination(cron); };
@@ -67,10 +74,12 @@ log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };
 log { source(src); filter(f_news); filter(f_crit); destination(newscrit); };
 log { source(src); filter(f_news); filter(f_err); destination(newserr); };
 log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); };
-log { source(src); filter(f_debug); destination(debug); };
+#log { source(src); filter(f_debug); destination(debug); };
 log { source(src); filter(f_messages); destination(messages); };
-log { source(src); filter(f_emergency); destination(console); };
+#log { source(src); filter(f_emergency); destination(console); };
 log { source(src); filter(f_ppp); destination(ppp); };
 log { source(src); destination(console_all); };
-log { source(src); destination(all); };
+#log { source(src); destination(all); };
 
+log { source(src); filter(f_ids); destination(ids); };
+log { source(src); filter(f_ssh); destination(ids); };
\ No newline at end of file