# /usr/local/etc/syslog-ng.conf
@version: 3.3

options {
	chain_hostnames(no); 
	check_hostname(yes);
	create_dirs(yes);
        dns_cache(yes); #
	flush_lines(1);
	keep_hostname(yes);
	log_fifo_size(10000); 
	log_msg_size(8192); 
	chain_hostnames(off);
	perm(0640);
	stats_freq(86400);
	time_reopen(10); 
        use_dns(yes); #
        use_fqdn(yes); #
};

source src		{
			internal();
			unix-dgram("/dev/log");
			unix-dgram("/var/lib/named/dev/log");
			};

parser pattern_db	{ db_parser ( file(/usr/local/var/patterndb.xml)); };

destination d_apache-logs 	{ file("/var/log/ispconfig/httpd/${.apache.domain}/${YEAR}${MONTH}${DAY}-access.log"
 				  template("${.apache.client_ip} ${.apache.ident_name} ${.apache.user_name} [${.apache.timestamp}] \"${.apache.request_url}\" ${.apache.request_status} ${.apache.content_length} \"${.apache.referer}\" \"${.apache.user_agent}\"\n")
				  template_escape(yes)
				  perm(0644));
				};

destination d_apache-logs-admin { file("/var/log/full/${.apache.domain}-access.log"
                                  template("${.apache.client_ip} ${.apache.ident_name} ${.apache.user_name} [${.apache.timestamp}] \"${.apache.request_url}\" ${.apache.request_status} ${.apache.content_length} \"${.apache.referer}\" \"${.apache.user_agent}\"\n")
                                  template_escape(yes));
                                };

destination d_ispconfig_apache-stat { program("/root/scripts/syslog/sql-log.sh"
				      template("INSERT INTO web_traffic VALUES ('${.apache.domain}',curdate(),${.apache.content_length}) ON duplicate KEY UPDATE traffic_bytes=traffic_bytes+${.apache.content_length};\n"));
				    };

filter f_apache2 		{ match("apache.access_log" value(".classifier.class"))
				  and not match("internal dummy connection" value(".apache.user_agent")); };

rewrite r_ano-apache            { subst("([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})","$1.$2.$3.0",
                                  value(".apache.client_ip"),flags("pcre") condition(tags("IPv4")));
                                  subst("([0-9a-f]{1,4})\:([0-9a-f]{1,4})\:([0-9a-f]{1,4})\:([0-9a-f]{1,4})","$1:$2:$3",
                                  value(".apache.client_ip"),flags("pcre") condition(tags("IPv6")));
                                };

log { source(src);		parser(pattern_db);
 				filter(f_apache2);
				rewrite(r_ano-apache);		destination (d_apache-logs);
								destination (d_ispconfig_apache-stat); };
