# /usr/local/etc/syslog-ng.conf
@version: 3.3

options {
	chain_hostnames(no); 
	check_hostname(yes);
	create_dirs(yes);
        dns_cache(yes); #
	flush_lines(1);
	keep_hostname(yes);
	log_fifo_size(10000); 
	log_msg_size(8192); 
	chain_hostnames(off);
	perm(0640);
	stats_freq(86400);
	time_reopen(10); 
        use_dns(yes); #
        use_fqdn(yes); #
};

source src		{
			internal();
			unix-dgram("/dev/log");
			unix-dgram("/var/lib/named/dev/log");
			};

destination db_traffic {
program("/usr/bin/mysql -usystemlog -pMYPASSWORD systemlog"
template("INSERT INTO clamavtraffic VALUES (inet_aton('${.apache.client_ip}') ,${.apache.content_length},CURRENT_TIMESTAMP,1 ) ON duplicate KEY UPDATE bytes=bytes+${.apache.content_length}, hits=hits+1;\n")
template-escape(yes));
};

destination d_apache-logs {
file("/var/log/httpd/${.apache.domain}/${YEAR}${MONTH}${DAY}-access.log"
template("${.apache.client_ip} ${.apache.ident_name} ${.apache.user_name} [${.apache.timestamp}] \"${.apache.request_url}\" ${.apache.request_status} ${.apache.content_length} \"${.apache.referer}\" \"${.apache.user_agent}\"\n")
template_escape(yes)
perm(0644));
};

filter f_mirror-traffic {
match ("200" value(".apache.request_status"));
};

filter f_apache2 {
program('apache2'); # apache use /bin/logger -t apache2
};

parser p_apache-access {
csv-parser(columns(
".apache.domain",
".apache.client_ip",
".apache.ident_name",
".apache.user_name",
".apache.timestamp",
".apache.timestamp2",
".apache.request_url",
".apache.request_status",
".apache.content_length",
".apache.referer",
".apache.user_agent")
flags(escape-double-char,strip-whitespace)
delimiters(" ")
quote-pairs('""\[\]') );
};

log {
source(src);
filter(f_apache2);
parser(p_apache-access);
#destination (d_apache-logs);
filter(f_mirror-traffic);
destination (db_traffic);
};
