905N/A# if you experience problems, check

905N/A# http://www.rsyslog.com/doc/troubleshoot.html for assistance

905N/A

6221N/A# The following template setting enables output matching legacy syslogd.

6221N/A# WARNING: removal will enable default rsyslog output which could

6221N/A# break scripts parsing logging output.

6221N/A$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

6221N/A

905N/A# rsyslog v3: load input modules

905N/A# If you do not load inputs, nothing happens!

905N/A

905N/A#$ModLoad immark # provides --MARK-- message capability

905N/A#$ModLoad imuxsock # can be used for rate-limiting and flow-control

905N/A$ModLoad imsolaris # for Solaris kernel logging

905N/A

4916N/A# Read drop-in files from /etc/rsyslog.d

4916N/A$IncludeConfig /etc/rsyslog.d/

905N/A

905N/A# High priority messages to the console

6221N/A*.err /dev/sysmsg

905N/A# Next highest priority to the messages file

6221N/A*.err;kern.debug;daemon.notice;auth.none;mail.crit /var/adm/messages

905N/A

905N/A# Preserve traditional Solaris syslog defaults

905N/A*.alert;kern.err;daemon.err :omusrmsg:operator

905N/A*.alert :omusrmsg:root

905N/A

6221N/A# kern.notice goes to a file until rsyslog learns how not to clutter

6221N/A# the console.

6221N/Akern.notice -/var/log/kern.log

905N/A

905N/A# Everybody gets emergency messages

905N/A*.emerg :omusrmsg:*

905N/A

6221N/Amail.debug /var/log/syslog

6221N/A

905N/A# Remote Logging (we use TCP for reliable delivery)

905N/A# An on-disk queue is created for this action. If the remote host is

905N/A# down, messages are spooled to disk and sent when it is up again.

905N/A#$WorkDirectory /var/spool/rsyslog # where to place spool files

905N/A#$ActionQueueFileName uniqName # unique name prefix for spool files

905N/A#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)

905N/A#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

905N/A#$ActionQueueType LinkedList # run asynchronously

905N/A#$ActionResumeRetryCount -1 # infinite retries if host is down

905N/A# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

905N/A#*.* @@remote-host:514

905N/A

905N/A

905N/A# ######### Receiving Messages from Remote Hosts ##########

905N/A# TCP Syslog Server:

905N/A# provides TCP syslog reception and GSS-API

905N/A#$ModLoad imtcp.so # load module

905N/A#$InputTCPServerRun 514 # start up TCP listener at port 514

905N/A

905N/A# UDP Syslog Server:

905N/A#$ModLoad imudp.so # provides UDP syslog reception

905N/A#$UDPServerAddress * # listen to all IP addresses

905N/A#$UDPServerRun 514 # start a UDP syslog server at standard port 514