<?xml version="1.0" encoding="GB2312"?>
<config>
  <system>
    <syslogport>514</syslogport>
    <sysloghandlewait>3</sysloghandlewait>
    <sysloghandlewaittime>5</sysloghandlewaittime>
    <syslogstatwait>3</syslogstatwait>
    <syslogindexnum>1000</syslogindexnum>
    <syslogcachetime>730</syslogcachetime>
  </system>
  <types>
    <type Name="facility" Class="falconet.service.syslog.filter.FacilityFilter" />
    <type Name="priority" Class="falconet.service.syslog.filter.PriorityFilter" />
    <type Name="program" Class="falconet.service.syslog.filter.ProgramFilter" />
    <type Name="host" Class="falconet.service.syslog.filter.HostFilter" />
    <type Name="match" Class="falconet.service.syslog.filter.MatchFilter" />
    <type Name="include" Class="falconet.service.syslog.action.FunctionAction" />
    <type Name="exclude" Class="falconet.service.syslog.action.FunctionAction" />
    <type Name="and" Class="falconet.service.syslog.action.FunctionAction" />
    <type Name="or" Class="falconet.service.syslog.action.FunctionAction" />
    <type Name="alert" Class="falconet.service.syslog.action.AlertAction" />
    <type Name="repeat" Class="falconet.service.syslog.analysis.RepeatAnalysis" />
    <type Name="logger" Class="falconet.service.syslog.action.LogFileAction" />
    <type Name="databaselogger" Class="falconet.service.syslog.action.LogDatabaseAction" />
  </types>
  <priorities>
    <priority Name="0" Text="emergency" />
    <priority Name="1" Text="alert" />
    <priority Name="2" Text="critical" />
    <priority Name="3" Text="error" />
    <priority Name="4" Text="warning" />
    <priority Name="5" Text="notice" />
    <priority Name="6" Text="info" />
    <priority Name="7" Text="debug" />
  </priorities>
  <facilities>
    <facility Name="0" Text="kernel" />
    <facility Name="1" Text="user" />
    <facility Name="2" Text="mail" />
    <facility Name="3" Text="daemon" />
    <facility Name="4" Text="auth" />
    <facility Name="5" Text="syslog" />
    <facility Name="6" Text="lpr" />
    <facility Name="7" Text="news" />
    <facility Name="8" Text="uucp" />
    <facility Name="9" Text="cron" />
    <facility Name="16" Text="local0" />
    <facility Name="17" Text="local1" />
    <facility Name="18" Text="local2" />
    <facility Name="19" Text="local3" />
    <facility Name="20" Text="local4" />
    <facility Name="21" Text="local5" />
    <facility Name="22" Text="local6" />
    <facility Name="23" Text="local7" />
  </facilities>
  <programs />
  <handles>
    <handle Type="alert" Severity="1" Effect="true" Description="日志致命告警" Name="致命规则">alert(and(priority(0)))</handle>
    <handle Type="alert" Severity="2" Effect="true" Description="日志严重告警" Name="严重规则">alert(and(priority(1,2)))</handle>
    <handle Type="alert" Severity="3" Effect="true" Description="日志警告信息" Name="告警规则">alert(and(priority(3,4)))</handle>
    <handle Type="logger" Effect="true" Description="logger" SaveTime="90" Name="logger">msyslog/data/log1;msyslog/data/log2;msyslog/data/log3</handle>
  </handles>
</config>

