# Загружаем модули приема удаленных syslog-сообщений по UDP и TCP
module(load="imudp")
module(load="imtcp")

# -----------------------------
# Шаблоны путей
# -----------------------------
# Каталоги строим по реальному IP источника.
# Это исключает смешивание устройств с одинаковым hostname.

template(name="RemoteAllPath" type="list") {
    constant(value="/var/log/remote/")
    property(name="fromhost-ip" securePath="replace")
    constant(value="/all.log")
}

template(name="RemoteFacilityPath" type="list") {
    constant(value="/var/log/remote/")
    property(name="fromhost-ip" securePath="replace")
    constant(value="/facility/")
    property(name="syslogfacility-text" securePath="replace")
    constant(value=".log")
}

template(name="RemoteSeverityPath" type="list") {
    constant(value="/var/log/remote/")
    property(name="fromhost-ip" securePath="replace")
    constant(value="/severity/")
    property(name="syslogseverity-text" securePath="replace")
    constant(value=".log")
}

# -----------------------------
# Шаблон строки для _alerts
# -----------------------------
template(name="AlertsFileFormat" type="string"
         string="%timereported:::date-rfc3339% %fromhost-ip% %syslogtag% %msg:::drop-last-lf%\n")

ruleset(name="RemoteLogs") {

    # Полный лог по устройству
    action(type="omfile"
           dynaFile="RemoteAllPath"
           template="RSYSLOG_TraditionalFileFormat"
           createDirs="on"
           dirCreateMode="0750"
           fileCreateMode="0640"
           dirGroup="syslog"
           fileGroup="syslog")

    # Раскладка по facility
    action(type="omfile"
           dynaFile="RemoteFacilityPath"
           template="RSYSLOG_TraditionalFileFormat"
           createDirs="on"
           dirCreateMode="0750"
           fileCreateMode="0640"
           dirGroup="syslog"
           fileGroup="syslog")

    # Раскладка по severity
    action(type="omfile"
           dynaFile="RemoteSeverityPath"
           template="RSYSLOG_TraditionalFileFormat"
           createDirs="on"
           dirCreateMode="0750"
           fileCreateMode="0640"
           dirGroup="syslog"
           fileGroup="syslog")

    # Общий технический файл ошибок
    if ($syslogseverity <= 3) then {
        action(type="omfile"
               file="/var/log/remote/_alerts/high.log"
               template="AlertsFileFormat"
               createDirs="on"
               dirCreateMode="0750"
               fileCreateMode="0640"
               dirGroup="syslog"
               fileGroup="syslog")
    }

    # 1. Немедленная авария
    if ($msg contains "PM-4-ERR_DISABLE"
        or $msg contains "SPANTREE-2-BLOCK_BPDUGUARD"
        or $msg contains "UDLD-4-UDLD_PORT_DISABLED"
        or $msg contains "SPANTREE-2-CHNL_MISCFG"
        or $msg contains "STORM_CONTROL-3-SHUTDOWN") then {
        action(type="omfile"
               file="/var/log/remote/_alerts/alerts_critical.log"
               template="AlertsFileFormat"
               createDirs="on"
               dirCreateMode="0750"
               fileCreateMode="0640"
               dirGroup="syslog"
               fileGroup="syslog")
    }

    # 2. Немедленное предупреждение
    if ($msg contains "SPANTREE-2-LOOPGUARD_BLOCK"
        or $msg contains "SPANTREE-2-ROOTGUARD_BLOCK"
        or $msg contains "STORM_CONTROL-3-FILTERED") then {
        action(type="omfile"
               file="/var/log/remote/_alerts/alerts_warning.log"
               template="AlertsFileFormat"
               createDirs="on"
               dirCreateMode="0750"
               fileCreateMode="0640"
               dirGroup="syslog"
               fileGroup="syslog")
    }

    # 3. Накопительные признаки
    if ($msg contains "MAC_MOVE-4-NOTIF"
        or $msg contains "SW_MATM-4-MACFLAP_NOTIF"
        or $msg contains "SPANTREE-5-TOPOTRAP"
        or $msg contains "SPANTREE-5-ROOTCHANGE") then {
        action(type="omfile"
               file="/var/log/remote/_alerts/alerts_behavior.log"
               template="AlertsFileFormat"
               createDirs="on"
               dirCreateMode="0750"
               fileCreateMode="0640"
               dirGroup="syslog"
               fileGroup="syslog")
    }

    stop
}

input(type="imudp" port="514" ruleset="RemoteLogs")
input(type="imtcp" port="514" ruleset="RemoteLogs")