# if you experience problems, check # http://www.rsyslog.com/troubleshoot for assistance $ModLoad immark # provides --MARK-- message capability $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support $ModLoad imjournal # Provides the ability to import log messages from systemd journal $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $FileOwner root $FileGroup root $FileCreateMode 0644 $DirCreateMode 0755 $Umask 0022 $SystemLogRateLimitInterval 2 $SystemLogRateLimitBurst 500 $WorkDirectory /var/spool/rsyslog $IncludeConfig /etc/rsyslog.d/*.conf $template DailyPerHostLogs,"/var/log/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%_messages.log" $template DynFile,"/var/log/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%_%programname%.log" $template DynMail,"/var/log/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%_maillog.log" $template DynCron,"/var/log/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%_cron.log" $template DynBoot,"/var/log/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%_boot.log" $template DynSpooler,"/var/log/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%_spooler.log" $template DynLighttpd,"/var/log/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%_lighttpd.log" if $programname contains 'lighttpd' then ?DynLighttpd & stop if $programname startswith 'lh_' then ?DynFile & stop # Log anything (except mail) of level info or higher. # Don't log private authentication messages! #*.info;mail.none;authpriv.none;cron.none -/var/log/messages *.info;mail.none;authpriv.none;cron.none;local6.none -?DailyPerHostLogs *.info;mail.none;authpriv.none;cron.none;local6.none -?DynFile # The authpriv file has restricted access. #authpriv.* /var/log/secure authpriv.* ?DynFile # Log all the mail messages in one place. #mail.* -/var/log/maillog mail.* ?DynMail # Log cron stuff #cron.* -/var/log/cron cron.* ?DynCron # Everybody gets emergency messages *.emerg :omusrmsg:* # Save news errors of level crit and higher in a special file. #uucp,news.crit -/var/log/spooler uucp,news.crit -?DynSpooler # Save boot messages also to boot.log #local7.* /var/log/boot.log local7.* ?DynBoot