905N/A# if you experience problems, check

905N/A# http://www.rsyslog.com/doc/troubleshoot.html for assistance

905N/A

905N/A# rsyslog v3: load input modules

905N/A# If you do not load inputs, nothing happens!

905N/A

905N/A#$ModLoad immark # provides --MARK-- message capability

905N/A#$ModLoad imuxsock # can be used for rate-limiting and flow-control

905N/A$ModLoad imsolaris # for Solaris kernel logging

905N/A

4916N/A# Read drop-in files from /etc/rsyslog.d

4916N/A$IncludeConfig /etc/rsyslog.d/

905N/A

905N/A# High priority messages to the console

905N/A*.err;kern.notice;auth.notice /dev/sysmsg

905N/A# Next highest priority to the messages file

905N/A*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages

905N/A

905N/A# Preserve traditional Solaris syslog defaults

905N/A*.alert;kern.err;daemon.err :omusrmsg:operator

905N/A*.alert :omusrmsg:root

905N/A

905N/A# Log anything (except auth, cron, daemon & mail) of level info or higher.

905N/A*.info;mail.none;auth.none;cron.none -/var/log/misc.log

905N/A

905N/A# Log all the auth, daemon & mail messages in one place.

905N/Aauth.* -/var/log/auth.log

905N/Adaemon.* -/var/log/daemon.log

905N/Amail.* -/var/log/mail.log

905N/A

905N/A# Everybody gets emergency messages

905N/A*.emerg :omusrmsg:*

905N/A

905N/A# Remote Logging (we use TCP for reliable delivery)

905N/A# An on-disk queue is created for this action. If the remote host is

905N/A# down, messages are spooled to disk and sent when it is up again.

905N/A#$WorkDirectory /var/spool/rsyslog # where to place spool files

905N/A#$ActionQueueFileName uniqName # unique name prefix for spool files

905N/A#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)

905N/A#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

905N/A#$ActionQueueType LinkedList # run asynchronously

905N/A#$ActionResumeRetryCount -1 # infinite retries if host is down

905N/A# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

905N/A#*.* @@remote-host:514

905N/A

905N/A

905N/A# ######### Receiving Messages from Remote Hosts ##########

905N/A# TCP Syslog Server:

905N/A# provides TCP syslog reception and GSS-API

905N/A#$ModLoad imtcp.so # load module

905N/A#$InputTCPServerRun 514 # start up TCP listener at port 514

905N/A

905N/A# UDP Syslog Server:

905N/A#$ModLoad imudp.so # provides UDP syslog reception

905N/A#$UDPServerAddress * # listen to all IP addresses

905N/A#$UDPServerRun 514 # start a UDP syslog server at standard port 514