## Bu dosya ansible tarafindan yonetilmektedir!
## Burada yapilan degisikliklerin uzerine yazilir!!
{{ ansible_managed }}

#################
#### MODULES ####
#################

module(load="imuxsock")
module(load="imklog")
module(load="imrelp")
module(load="imudp" threads="{{ rsyslog['imthreads'] }}")

main_queue(
   queue.size="{{ rsyslog['MainQueueSize'] }}"
   queue.workerthreads="{{ rsyslog['MainQueueWorkerThreads'] }}"
)

template(name="MsgFormat" type="string" string="%msg:2:10000%\n")

############################
### Listening To Sources ###
############################

input(type="imudp"
   port="{{ rsyslog['port_udp'] }}"
   ruleset="RawLogs"
)

input(type="imrelp"
   port="{{ rsyslog['port'] }}"
   ruleset="RawLogs"
   tls="{{ rsyslog['tls']['state'] }}"
   tls.caCert="{{ rsyslog['tls']['cacert'] }}"
   tls.myCert="{{ rsyslog['tls']['mycert'] }}"
   tls.myPrivKey="{{ rsyslog['tls']['myprivkey'] }}"
   tls.authMode="{{ rsyslog['tls']['authmode'] }}"
   tls.permittedpeer=["{{ rsyslog['tls']['permittedpeer'] }}"]
)

####################################
### Rules For Coming Logs/Alerts ###
####################################

ruleset(name="RawLogs") {
   {% for key, value in sources.iteritems() %}
   if ($fromhost-ip == '{{ value.addr }}' and $msg contains 'AV - Alert -') then {
      action(name="{{ value.alertname }}"
         type="omfile"
         file="{{ value.alertfile }}"
         asyncWriting="{{ rsyslog['asyncWriting'] }}"
         ioBufferSize="{{ rsyslog['ioBufferSize'] }}"
         template="MsgFormat"
      )
      stop
   } else if ($fromhost-ip == '{{ value.addr }}') then {
      action(name="{{ value.rawname }}"
         type="omfile"
         file="{{ value.rawfile }}"
         asyncWriting="{{ rsyslog['asyncWriting'] }}"
         ioBufferSize="{{ rsyslog['ioBufferSize'] }}"
      )
      stop
   }
   {% endfor %}
}


auth,authpriv.*			/var/log/auth.log
*.*;auth,authpriv.none		-/var/log/syslog
#cron.*				/var/log/cron.log
daemon.*			-/var/log/daemon.log
kern.*				-/var/log/kern.log
lpr.*				-/var/log/lpr.log
mail.*				-/var/log/mail.log
user.*				-/var/log/user.log

mail.info			-/var/log/mail.info
mail.warn			-/var/log/mail.warn
mail.err			/var/log/mail.err

news.crit			/var/log/news/news.crit
news.err			/var/log/news/news.err
news.notice			-/var/log/news/news.notice

$WorkDirectory {{ rsyslog['WorkDirectory'] }}
$IncludeConfig {{ rsyslog['IncludeConfig'] }}
