## Bu dosya ansible tarafindan yonetilmektedir!
## Burada yapilan degisikliklerin uzerine yazilir!!
{{ ansible_managed }}

#################
#### MODULES ####
#################

module(load="imklog")
module(load="imfile" mode="{{ rsyslog['Mode'] }}")
module(load="imuxsock")
module(load="omrelp")

main_queue(
   queue.size="{{ rsyslog['MainQueueSize'] }}"
   queue.workerthreads="{{ rsyslog['MainQueueWorkerThreads']}}"
)

####################
### Ansible Logs ###
####################

ruleset(name="AnsibleLogs") {
   action(name="Ansible-Log-Gonderme"
      type="omrelp"
{% for key, value in ossimciks.iteritems() %}
{% if ansible_fqdn in value.clients %}
      target="{{ value.fqdn }}"
      port="{{ value.port }}"
{% endif %}
{% endfor %}
      tls="{{ rsyslog['tls']['state'] }}"
      tls.caCert="{{ rsyslog['tls']['cacert'] }}"
      tls.myCert="{{ rsyslog['tls']['mycert'] }}"
      tls.myPrivKey="{{ rsyslog['tls']['mykey'] }}"
      tls.authmode="{{ rsyslog['tls']['authmode'] }}"
      tls.permittedpeer=["{{ rsyslog['tls']['permittedpeer'] }}"]
      queue.Type="{{ rsyslog['QueueType'] }}"
      queue.FileName="{{ rsyslog['QueueFileNameANS'] }}"
      queue.SaveOnShutdown="{{ rsyslog['QueueSaveOnShutdown'] }}"
      queue.MaxFileSize="{{ rsyslog['QueueMaxFileSize'] }}"
      action.resumeRetryCount="{{ rsyslog['ActionResumeRetryCount'] }}"
   )
   stop
}

input(type="imfile"
   file="/var/log/ahtapot/ansible.log"
   tag=""
   ruleset="AnsibleLogs")

{% if ansible_fqdn in groups['suricata_ips'] or ansible_fqdn in groups['suricata_ids'] %}
#####################
### Suricata Logs ###
#####################

ruleset(name="SuricataLogs") {
   action(name="Suricata-Log-Gonderme"
      type="omrelp"
{% for key, value in ossimciks.iteritems() %}
{% if ansible_fqdn in value.clients %}
      target="{{ value.fqdn }}"
      port="{{ value.port }}"
{% endif %}
{% endfor %}
      tls="{{ rsyslog['tls']['state'] }}"
      tls.caCert="{{ rsyslog['tls']['cacert'] }}"
      tls.myCert="{{ rsyslog['tls']['mycert'] }}"
      tls.myPrivKey="{{ rsyslog['tls']['mykey'] }}"
      tls.authmode="{{ rsyslog['tls']['authmode'] }}"
      tls.permittedpeer=["{{ rsyslog['tls']['permittedpeer'] }}"]
      queue.Type="{{ rsyslog['QueueType'] }}"
      queue.FileName="{{ rsyslog['QueueFileNameSURICATA'] }}"
      queue.SaveOnShutdown="{{ rsyslog['QueueSaveOnShutdown'] }}"
      queue.MaxFileSize="{{ rsyslog['QueueMaxFileSize'] }}"
      action.resumeRetryCount="{{ rsyslog['ActionResumeRetryCount'] }}"
   )
   stop
}

input(type="imfile"
   file="/var/log/suricata/fast.log"
   tag=""
   ruleset="SuricataLogs")
{% endif %}



#####################
### IPtables Logs ###
#####################

if $msg contains 'RULE' then {
   action(name="IPtables-Yerele-Log-Yazma"
      type="omfile"
      file="/var/log/ahtapot/fw/iptables.log"
      asyncWriting="{{ rsyslog['asyncWriting'] }}"
      ioBufferSize="{{ rsyslog['ioBufferSize'] }}"
   )
   
   action(name="IPtables-Log-Gonderme"
      type="omrelp"
{% for key, value in ossimciks.iteritems() %}
{% if ansible_fqdn in value.clients %}
      target="{{ value.fqdn }}"
      port="{{ value.port }}"
{% endif %}
{% endfor %}
      tls="{{ rsyslog['tls']['state'] }}"
      tls.caCert="{{ rsyslog['tls']['cacert'] }}"
      tls.myCert="{{ rsyslog['tls']['mycert'] }}"
      tls.myPrivKey="{{ rsyslog['tls']['mykey'] }}"
      tls.authmode="{{ rsyslog['tls']['authmode'] }}"
      tls.permittedpeer=["{{ rsyslog['tls']['permittedpeer'] }}"]
      queue.Type="{{ rsyslog['QueueType'] }}"
      queue.FileName="{{ rsyslog['QueueFileNameIPT'] }}"
      queue.SaveOnShutdown="{{ rsyslog['QueueSaveOnShutdown'] }}"
      queue.MaxFileSize="{{ rsyslog['QueueMaxFileSize'] }}"
      queue.size="{{ rsyslog['QueueSize'] }}"
      action.resumeRetryCount="{{ rsyslog['ActionResumeRetryCount'] }}"
   )
   stop
}

###################
### ALL Syslogs ###
###################

action(name="Butun-SYSLOG-Gonderme"
   type="omrelp"
{% for key, value in ossimciks.iteritems() %}
{% if ansible_fqdn in value.clients %}
   target="{{ value.fqdn }}"
   port="{{ value.port }}"
{% endif %}
{% endfor %}
   tls="{{ rsyslog['tls']['state'] }}"
   tls.caCert="{{ rsyslog['tls']['cacert'] }}"
   tls.myCert="{{ rsyslog['tls']['mycert'] }}"
   tls.myPrivKey="{{ rsyslog['tls']['mykey'] }}"
   tls.authmode="{{ rsyslog['tls']['authmode'] }}"
   tls.permittedpeer=["{{ rsyslog['tls']['permittedpeer'] }}"]
   queue.Type="{{ rsyslog['QueueType'] }}"
   queue.FileName="{{ rsyslog['QueueFileNameSYS'] }}"
   queue.SaveOnShutdown="{{ rsyslog['QueueSaveOnShutdown'] }}"
   queue.MaxFileSize="{{ rsyslog['QueueMaxFileSize'] }}"
   queue.size="{{ rsyslog['QueueSize'] }}"
   action.resumeRetryCount="{{ rsyslog['ActionResumeRetryCount'] }}"
)

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none,kern.!=info      -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*;kern.!=info              -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;kern.!=info;\
        mail,news.none          -/var/log/messages

*.emerg                         :omusrmsg:*

$WorkDirectory {{ rsyslog['WorkDirectory'] }} 
$IncludeConfig {{ rsyslog['IncludeConfig'] }}
