# /etc/rsyslog.conf: rsyslogd configuration file # # rsyslog is considered a part of Adiscon's MonitorWare product line. # As such, you can find current information as well as information on the # other product line members on http://www.monitorware.com. Please be warned, there # are a number of closed-source commercial Windows applications among these products ;) # # You might want to check the GPL'd phpLogCon as a web-based front-end to a syslog # message database. # # I hope you find this work useful! # Rainer Gerhards # If you do not load inputs, nothing happens! # You may need to set the module load path if modules are not found. # $ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command) $ModLoad imklog.so # kernel logging (formerly provided by rklogd) # Log all kernel messages # kern.* /var/log/kern.log # Log anything (except mail) of level info or higher. # Don't log private authentication messages! # *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. # authpriv.* /var/log/auth.log # Log all the mail messages # mail.* -/var/log/mail.log # Log cron stuff # cron.* /var/log/cron.log # Everybody gets emergency messages # *.emerg * # Save news errors of level crit and higher # uucp,news.crit /var/log/spooler.log # Save boot messages also to boot.log # local7.* /var/log/boot.log # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @@remote-host # Remote Logging (we use TCP for reliable delivery) # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. # #$WorkDirectory /rsyslog/spool # where to place spool files #$ActionQueueFileName uniqName # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinety retries if host is down ######### Receiving Messages from Remote Hosts ########## # # See http://rsyslog.com/doc for more information and examples # # TCP Syslog Server: # provides TCP syslog reception and GSS-API (if compiled to support it) # #$ModLoad imtcp.so # load module # Note: as of now, you need to use the -t command line option to # enable TCP reception (e.g. -t514 to run a server at port 514/tcp) # This will change in later v3 releases. # UDP Syslog Server: # #$ModLoad imudp.so # provides UDP syslog reception #$UDPServerRun 514 # start a UDP syslog server at standard port 514