1 # /etc/rsyslog.conf Configuration file for rsyslog.
3 # For more information see
4 # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
11 $ModLoad imuxsock # provides support for local system logging
12 $ModLoad immark # provides --MARK-- message capability
13 $MarkMessagePeriod 900 # mark messages appear every 15 Minutes
15 ###########################
16 #### GLOBAL DIRECTIVES ####
17 ###########################
20 # Use traditional timestamp format.
21 # To enable high precision timestamps, comment out the following line.
23 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
26 # Set the default permissions for all log files.
35 # Include all config files in /etc/rsyslog.d/
37 $IncludeConfig /etc/rsyslog.d/*.conf
39 # Store any queues here. This directory is not created automatically, so it
41 $WorkDirectory /var/spool/rsyslog
43 # Use a (disk-assisted) main queue
44 # Use a linked list for queueing
45 $MainMsgQueueType LinkedList
46 # Name to use for the queue file
47 $MainMsgQueueFileName main
48 # save in-memory data if rsyslog shuts down
49 $MainMsgQueueSaveOnShutdown on
51 #######################
52 #### Local logging ####
53 #######################
56 # Log each facility into its own log
57 auth,authpriv.* /var/log/rsyslog/auth.log
58 cron.* -/var/log/rsyslog/user.log
59 daemon.* -/var/log/rsyslog/daemon.log
60 kern.* -/var/log/rsyslog/kern.log
61 lpr.* -/var/log/rsyslog/lpr.log
62 mail.* -/var/log/rsyslog/mail.log
63 user.* -/var/log/rsyslog/user.log
64 local0,local1,local2,\
65 local3,local4,local5,\
66 local6,local7.* -/var/log/rsyslog/local.log
68 # Omitted facilities: syslog, news, uucp, ftp
70 # All logs end up in syslog as weel as the corresponding facility log above
71 # (except for auth, mail which only end up in the facility log for privacy
72 # reasons and debug which only ends up in the debug log below to prevent
77 mail.none -/var/log/rsyslog/syslog
79 # Debug entries end up in debug.log as well as the corresponding facility log
80 # above (except for auth and mail, which only end up in the facility logs for
84 news.none;mail.none -/var/log/rsyslog/debug.log
86 # Emergencies are sent to everybody logged in.
90 ########################
91 #### Remote logging ####
92 ########################
94 # Send all log entries to the log vserver, but queue them in memory as well as
96 # Use a linked list for queueing
97 $ActionQueueType LinkedList
98 # Name to use for the queue file
99 $ActionQueueFileName remote
100 # infinite retries on insert failure
101 $ActionResumeRetryCount -1
102 # save in-memory data if rsyslog shuts down
103 $ActionQueueSaveOnShutdown on
105 #*.* @@log.local;RSYSLOG_SyslogProtocol23Format