# Configuration file for syslog.monitor
# $Id: syslog-monitor.conf,v 1.2 2004/11/15 14:45:18 vitroth Exp $
#############################################################################
# Which timeout to set for select()ing on the input socket.
# You really do not wish to play with this.

# select_timeout 10

# Log level (just like syslog you know;)
loglevel 6

# If undefined, will write to stdout
# You better specify an absolute path here.
# logfile /var/log/syslog.monitor

# Where copies of incoming syslog messages get written to.
# In the filename, you can define the following substitutions:
# %H = gets replaced with the hostname
# %L = gets replaced with the syslog level as a string
# %l = same, but as a number
# %F = syslog facility (local0, kern, ...)
# %G = hostgroup the host belongs to
# %D = date at which the message was received, in ISO 8601 (1999-04-03)
syslogfile /var/log/syslog.%H.%F.%D

# If set, will make syslog.monitor fork and go into the background as soon 
# as possible.
# Be aware that the program will refuse to daemonize if you do not set a logfile.
# daemon_mode

mon_host cherusker.bi.teuto.net
# Set these if necessary
# mon_user
# mon_pass

# IP number on which to listen for incomeing UDP packets
bind_ip 0.0.0.0
# port number (you almost certainly do not want to touch this)
# bind_port 514

# Define a check called "emerg"
check emerg
  # A slightly more elaborate description, which is sent to the mon server
  # as part of the trap
  desc Emergencies
  # The period which is monitored
  period 60m
  # How often this check _must_ trigger within said period.
  # Set to -1 to disable.
  min -1
  # How often this check might occur at max within the period.
  max 3
  # If this is set, no further matches will be checked if this check matched.
  # Use this carefully.
  # final
  # The check itself. Evaluated within Perl (), you can do powerful stuff
  # here. The current message is referenced by $$r.
  # Parameters you might want to match on:
  # $$r{'src_port'} - The source port from which the packert was sent.
  # $$r{'src_ip'}   - The source IP.
  # $$r{'host'}     - The hostname, resolved using the cache build
  #                   at startup.
  # $$r{'level'}    - numeric syslog level of the message. (0-7)
  # $$r{'Level'}    - syslog level as a string (ie 'crit')
  # $$r{'facility'} - Facility (ie 'local0' etc)
  # $$r{'msg'}      - The text part of the message
  # $$r{'time'}     - The unixtime at which the message was received,
  # $$r{'group'}    - The group the host sending this message
  #                   belongs to
  pattern ($$r{'level'} <=3)

# A "catch-all" - we really should receive at least one line within 15m,
# But more than 1000 might be strange...
check all
  desc All
  period 15m
  min 200
  max 10000
  final
  pattern (1)

# Relating to hostgroup unix:
group unix
  # For each host in the hostgroup unix, run a separate instance of each
  # check listed here (references the check defined above)
  per-host emerg
  # For the _entire_ hostgroup, run these checks:
  per-group all
  # Only on this host, run these:
  # on-host donar.bi.teuto.net emerg-kern
