Lorem Ipsum

BALABIT/SAWMILL
INSTALLATION GUIDE
1. INSTALLATION AND CONFIGURATION OF BALABIT LOG
COLLECTION

2. SAWMILL LOGS AND REPORT CONFIGURATION

INTRODUCTION TO SYSLOGNG
THE PHILOSOPHY OF SYSLOG-NG
syslog-ng is used to manage log messages and implement centralized logging,
where the aim is to collect the log messages of several devices on a single, central
log server. The different devices called syslog-ng clients all run syslog-ng, and
collect the log messages from the various applications, files, and other sources. The
clients send all important log messages to the remote syslog-ng server, which sorts
and stores them.

LOGGING WITH SYSLOG-NG

The syslog-ng application reads incoming messages and forwards them to the
selected destinations. The syslog-ng application can receive messages from files,
remote hosts, and other sources.
Log messages enter syslog-ng in one of the defined sources, and are sent to one or
more destinations.
Sources and destinations are independent objects; log paths define what syslog-ng
does with a message, connecting the sources to the destinations. A log path consists
of one or more sources and one or more destinations; messages arriving from a
source are sent to every destination listed in the log path. A log path defined in
syslog-ng is called a log statement.
Optionally, log paths can include filters. Filters are rules that select only certain
messages, for example, selecting only messages sent by a specific application. If a
log path includes filters, syslog-ng sends only the messages satisfying the filter rules
to the destinations set in the log path.
Other optional elements that can appear in log statements are parsers and rewriting
rules. Parsers segment messages into different fields to help processing the
messages, while rewrite rules modify the messages by adding, replacing, or
removing parts of the messages.

The following procedure illustrates the route of a log message from its
source on the syslog-ng client to its final destination on the central syslogng server and log destinations include the Sawmill directories for analysis.