<?xml version='1.0' encoding='utf-8'?>

<creole>

    <files>
        <service method="restartonly">rsyslog</service>
        <file name='/etc/logrotate.d/rsyslog' source='rsyslog.logrotate'/>
        <file name='/etc/rsyslog.conf'/>
        <file name='/etc/rsyslog.d/aggregation/all.conf' source='rsyslog_aggregation.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/templates/eole_templates.conf' source='rsyslog_templates.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/eole-views/errors.conf' source='rsyslog_views_errors.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/eole-views/auth.conf' source='rsyslog_views_auth.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/eole-traps/rsyslog.conf' source='rsyslog_traps_rsyslog.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/eole-traps/cron.conf' source='rsyslog_traps_cron.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/eole-traps/iptables.conf' source='rsyslog_traps_iptables.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/eole-traps/gpm.conf' source='rsyslog_traps_gpm.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/eole-traps/zephir.conf' source='rsyslog_traps_zephir.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/eole-traps/eole.conf' source='rsyslog_traps_eole.conf' mkdir="True"/>
        <file name='/etc/rsyslog.d/default_dispatching.conf' source='rsyslog_default_dispatching.conf'/>
        <file name='/etc/rsyslog.d/eole-traps/xmlrpc.conf' source='rsyslog_traps_xmlrpc.conf' mkdir="True"/>
        <file name='/etc/systemd/journald.conf.d/01-size.conf' source='journald_limit_size' mkdir='True'/>
        <service_access service='rsyslog_udp'>
            <port protocol='udp'>514</port>
        </service_access>
        <service_restriction service='rsyslog_udp'>
            <ip interface='auto' netmask='netmask_client_logs_udp' netmask_type='SymLinkOption' ip_type='SymLinkOption'>adresses_ip_clients_logs_udp</ip>
        </service_restriction>
        <service_access service='rsyslog_tcp'>
            <port>10514</port>
        </service_access>
        <service_restriction service='rsyslog_tcp'>
            <ip interface='auto' netmask='netmask_client_logs_tcp' netmask_type='SymLinkOption' ip_type='SymLinkOption'>adresses_ip_clients_logs_tcp</ip>
        </service_restriction>
        <service_access service='rsyslog_relp'>
            <port>20514</port>
        </service_access>
        <service_restriction service='rsyslog_relp'>
            <ip interface='auto' netmask='netmask_client_logs_relp' netmask_type='SymLinkOption' ip_type='SymLinkOption'>adresses_ip_clients_logs_relp</ip>
        </service_restriction>
    </files>

    <variables>
        <family name='services'>
            <variable name='activer_log_distant' type='oui/non' description="Activer la gestion des logs centralisés" mode="expert">
                <value>non</value>
            </variable>
        </family>
        <family name='logs' icon='edit'>
            <variable name='journald_max_use' type='number' description='Taille maximale du journal (Mo)' mode='expert'>
                <value>100</value>
            </variable>
            <variable name='journald_max_files' type='number' description='Objectif de nombre maximal de journaux à conserver' mode='expert'>
                <value>100</value>
            </variable>
            <variable name='activer_reception_logs' type='oui/non' description='Activer la réception des logs de machines distantes'>
                <value>non</value>
            </variable>
            <variable name='activer_reception_logs_relp' type='oui/non' description='Activer la réception des logs de machines distantes via le protocole RELP (fiable, non compatible TLS)'>
                <value>non</value>
            </variable>
            <variable name='adresses_ip_clients_logs_relp' type='network' description='IP des clients à autoriser pour le protocole RELP' multi='True' mandatory='True'/>
            <variable name='netmask_client_logs_relp' type='netmask' description="Masque du sous réseau" mandatory='True'/>
            <variable name='activer_reception_logs_udp' type='oui/non' description='Activer la réception des logs de machines distantes via le protocole UDP'>
                <value>non</value>
            </variable>
            <variable name='adresses_ip_clients_logs_udp' type='network' description="Adresse IP équipement autorisé" multi='True' mandatory='True'/>
            <variable name='netmask_client_logs_udp' type='netmask' description="Masque du sous réseau" mandatory='True'/>
            <variable name='activer_reception_logs_tcp' type='oui/non' description='Activer la réception des logs de machines distantes via le protocole TCP (compatible TLS)'>
                <value>non</value>
            </variable>
            <variable name='rsyslog_reception_tls' type='oui/non' description="Activer le chiffrement des transferts pour la réception (TLS)"  hidden='True'>
                <value>non</value>
            </variable>
            <variable name='adresses_ip_clients_logs_tcp' type='network' description='IP des clients à autoriser pour le protocole TCP' multi='True' mandatory='True'/>
            <variable name='netmask_client_logs_tcp' type='netmask' description="Masque du sous réseau" mandatory='True'/>
            <variable name='tls_activated' type='oui/non' description="TLS activé" hidden='True'>
                <value>non</value>
            </variable>
            <variable name='activer_envoi_logs' type='oui/non' description="Activer l'envoi des logs à une machine distante (TCP si TLS activé, RELP sinon)">
                <value>non</value>
            </variable>
            <variable name='adresse_ip_serveur_logs' type='ip' description='Adresse IP du serveur de log central' mandatory='True'/>
            <variable name='rsyslog_envoi_tls' type='oui/non' description="Activer le chiffrement des transferts pour l'envoi (TLS)" >
                <value>non</value>
            </variable>
            <variable name='rsyslog_ca_file' type='filename' description="Emplacement de la CA">
                <value>/etc/ssl/certs/ca_local.crt</value>
            </variable>
            <variable name='rsyslog_privkey_file' type='filename' description="Emplacement de la clé">
                <value>/etc/rsyslog.d/ssl/private/rsyslog.key</value>
            </variable>
            <variable name='rsyslog_cert_file' type='filename' description="Emplacement du certificat">
                <value>/etc/rsyslog.d/ssl/certs/rsyslog.crt</value>
            </variable>
            <variable name='envoyer_tous_logs' type='oui/non' description='Envoyer tous les journaux'>
                <value>oui</value>
            </variable>
            <variable name='utiliser_rsyslog_plage_envoi_globale' type='oui/non' description="Utiliser une plage temporelle pour le transfert des logs">
                <value>non</value>
            </variable>
            <variable name='rsyslog_plage_globale_heure_debut' type='string' description="Heure de début du transfert des logs"/>
            <variable name='rsyslog_plage_globale_heure_fin' type='string' description="Heure de fin du transfert des logs"/>
        </family>
        <separators>
            <separator name='journald_max_use'>Configuration de journald</separator>
            <separator name='activer_reception_logs'>Réception</separator>
            <separator name='activer_envoi_logs'>Envoi</separator>
            <separator name='rsyslog_ca_file'>Certificats</separator>
            <separator name='envoyer_tous_logs'>Choix des journaux à envoyer</separator>
        </separators>
    </variables>

    <constraints>
        <check name='valid_enum' target='rsyslog_plage_globale_heure_debut'>
            <param>["1","2","3","4","5","6","7","8","9","10","11","12","13","14","15","16","17","18","19","20","21","22","23","24"]</param>
        </check>
        <check name='valid_enum' target='rsyslog_plage_globale_heure_fin'>
            <param>["1","2","3","4","5","6","7","8","9","10","11","12","13","14","15","16","17","18","19","20","21","22","23","24"]</param>
        </check>

        <condition name='disabled_if_in' source='activer_log_distant'>
            <param>non</param>
            <target type='variable'>activer_reception_logs</target>
            <target type='variable'>activer_envoi_logs</target>
        </condition>
        <condition name='disabled_if_in' source='activer_reception_logs'>
            <param>non</param>
            <target type='variable'>activer_reception_logs_relp</target>
            <target type='variable'>activer_reception_logs_tcp</target>
            <target type='variable'>activer_reception_logs_udp</target>
        </condition>
        <condition name='disabled_if_in' source='activer_reception_logs_udp'>
            <param>non</param>
            <target type='variable'>adresses_ip_clients_logs_udp</target>
            <target type='variable'>netmask_client_logs_udp</target>
        </condition>
        <condition name='disabled_if_in' source='activer_reception_logs_tcp'>
            <param>non</param>
            <target type='variable'>adresses_ip_clients_logs_tcp</target>
            <target type='variable'>netmask_client_logs_tcp</target>
            <target type='variable'>rsyslog_reception_tls</target>
        </condition>
        <condition name='disabled_if_in' source='activer_reception_logs_relp'>
            <param>non</param>
            <target type='variable'>adresses_ip_clients_logs_relp</target>
            <target type='variable'>netmask_client_logs_relp</target>
        </condition>
        <condition name='disabled_if_in' source='activer_envoi_logs'>
            <param>non</param>
            <target type='variable'>adresse_ip_serveur_logs</target>
            <target type='variable'>rsyslog_envoi_tls</target>
            <target type='variable'>envoyer_tous_logs</target>
        </condition>
        <auto name='calc_multi_condition' target='tls_activated'>
            <param>oui</param>
            <param name="operator">OR</param>
            <param type='eole' name='condition_1' hidden='False'>rsyslog_envoi_tls</param>
            <param type='eole' name='condition_2' hidden='False'>activer_reception_logs_tcp</param>
            <param name='match'>oui</param>
            <param name='mismatch'>non</param>
        </auto>
        <condition name='disabled_if_in' source='tls_activated'>
            <param>non</param>
            <target type='variable'>rsyslog_ca_file</target>
            <target type='variable'>rsyslog_privkey_file</target>
            <target type='variable'>rsyslog_cert_file</target>
        </condition>
        <condition name='disabled_if_in' source='envoyer_tous_logs'>
            <param>non</param>
            <target type='variable'>utiliser_rsyslog_plage_envoi_globale</target>
        </condition>
        <condition name='disabled_if_in' source='utiliser_rsyslog_plage_envoi_globale'>
            <param>non</param>
            <target type='variable'>rsyslog_plage_globale_heure_debut</target>
            <target type='variable'>rsyslog_plage_globale_heure_fin</target>
        </condition>
        <group master='adresses_ip_clients_logs_udp'>
            <slave>netmask_client_logs_udp</slave>
        </group>
        <group master='adresses_ip_clients_logs_tcp'>
            <slave>netmask_client_logs_tcp</slave>
        </group>
        <group master='adresses_ip_clients_logs_relp'>
            <slave>netmask_client_logs_relp</slave>
        </group>

        <check name="valid_networknetmask" target="netmask_client_logs_tcp">
            <param type='eole'>adresses_ip_clients_logs_tcp</param>
        </check>

        <check name="valid_networknetmask" target="netmask_client_logs_udp">
            <param type='eole'>adresses_ip_clients_logs_udp</param>
        </check>
        <check name="valid_networknetmask" target="netmask_client_logs_relp">
            <param type='eole'>adresses_ip_clients_logs_relp</param>
        </check>
    </constraints>

    <help>
        <family name='logs'>Configuration de la réception et/ou de l'envoi des journaux système et de leur conservation</family>
        <variable name='journald_max_use'>Quantité d’espace maximal utilisé pour la journalisation journald, sur disque ou en mémoire</variable>
        <variable name='journald_max_files'>Objectif de nombre maximal de fichiers pouvant être atteint par la suppression des journaux archivés</variable>
    </help>

</creole>
<!-- vim: ts=4 sw=4 expandtab
-->
