1 #rsyslog v4 config file
3 # if you experience problems, check
4 # http://www.rsyslog.com/troubleshoot for assistance
8 $ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)
9 $ModLoad imklog.so # provides kernel logging support (previously done by rklogd)
10 #$ModLoad immark.so # provides --MARK-- message capability
12 # Provides UDP syslog reception
16 # Provides TCP syslog reception
18 #$InputTCPServerRun 514
21 # ### GLOBAL DIRECTIVES ####
24 # Use traditional timestamp format.
25 # To enable high precision timestamps, comment out the following line.
26 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
28 # File syncing capability is disabled by default. This feature is usually not required,
29 # not useful and an extreme performance hit.
30 # Without that dash doesn't work.
31 #$ActionFileEnableSync on
34 # Set the default permissions for all log files.
44 # Log all kernel messages to the console.
45 # Logging much else clutters up the screen.
48 # The authpriv file has restricted access.
49 authpriv.* /var/log/secure
51 # Log all the mail messages in one place.
52 mail.* -/var/log/maillog
57 # Everybody gets emergency messages
60 # Save news errors of level crit and higher in a special file.
61 uucp,news.crit /var/log/spooler
63 # Save boot messages also to boot.log
64 local7.* /var/log/boot.log
67 # Some "catch-all" log files.
71 news.none;mail.none -/var/log/debug
72 *.=info;*.=notice;*.=warn;\
75 mail,news.none -/var/log/messages
77 # ### Additional - from wiki ###
78 # A basic template mostly from the docs, but I wanted to know what system forwarded the
79 # messages so I added some text. Also I added the ":::space" to handle the windows
80 # events (based on the other suggestions in the wiki)
82 # $template SyslFormat,"%timegenerated% [WJCG]-%HOSTNAME% %syslogtag%%msg:::space$
84 # this is for Windows events from SNARE
86 # $EscapeControlCharactersOnReceive off
90 # reduce any duplicates
92 # $RepeatedMsgReduction on
93 # $OptimizeForUniprocessor on
97 # ### Begin forwarding rule ###
98 # The statement between the begin ... end define a SINGLE forwarding
99 # rule. They belong together, do NOT split them. If you create multiple
100 # forwarding rules, duplicate the whole block!
101 # Remote Logging (we use TCP for reliable delivery)
103 # An on-disk queue is created for this action. If the remote host is
104 # down, messages are spooled to disk and sent when it is up again.
105 #$WorkDirectory /var/spppl/rsyslog # where to place spool files
106 #$ActionQueueFileName fwdRule1 # unique name prefix for spool files
107 #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
108 #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
109 #$ActionQueueType LinkedList # run asynchronously
110 #$ActionResumeRetryCount -1 # infinite retries if host is down
111 # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
112 #*.* @@remote-host:514
116 # ### For central logs server use an example: host/year/month/day/facility ###
118 #$template DailyPerHostLogs,"/var/log/remote/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/%syslogfacility-text%" #*.* -?DailyPerHostLogs