<!--
  systemd journal collection.
  location and log_format must both be journald.

  Filters inside one <localfile> block combine with AND.
  Separate <localfile> blocks combine with OR.
  If at least one journald block has filters, blocks without filters are
  ignored, so a single filtered block turns off "collect everything".

  Reference:
  https://documentation.wazuh.com/5.0-beta/user-manual/reference/ossec-conf/localfile.html
-->

<!-- All SSH unit messages. -->
<localfile>
  <location>journald</location>
  <log_format>journald</log_format>
  <filter field="_SYSTEMD_UNIT">^ssh.service$</filter>
</localfile>

<!-- High-severity cron messages, plus cron entries with no PRIORITY field.
     ignore_if_missing="yes" accepts a log that lacks the field. -->
<localfile>
  <location>journald</location>
  <log_format>journald</log_format>
  <filter field="_SYSTEMD_UNIT">^cron.service$</filter>
  <filter field="PRIORITY" ignore_if_missing="yes">[0-3]</filter>
</localfile>

<!-- Everything sudo emits, regardless of the unit that called it. -->
<localfile>
  <location>journald</location>
  <log_format>journald</log_format>
  <filter field="_COMM">^sudo$</filter>
</localfile>
