blob: 83dc799206b86400c88f48ac22c1addcf2f3e294 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
module(load="imklog")
module(load="imuxsock" SysSock.name="/run/systemd/journal/syslog")
module(load="imfile")
module(load="omrelp" tls.tlslib="openssl")
global(
workDirectory="/var/lib/rsyslog"
parser.escapecontrolcharactertab="off"
)
module(
load="builtin:omfile"
template="RSYSLOG_TraditionalFileFormat"
fileOwner="root"
fileGroup="root"
fileCreateMode="0600"
dirCreateMode="0700"
)
include(file="/etc/rsyslog.d/*.conf" mode="optional")
# if message didn't come from imfile, process as normal.
if ($!metadata!filename == '') then {
# EL defaults
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
}
{% if rsyslog_forward %}
# forward to syslog server
if prifilt("*.info") then {
action(type="omrelp"
template="RSYSLOG_ForwardFormat"
target="{{ rsyslog_target }}"
{% if rsyslog_tls %}
port="{{ rsyslog_relp_tls_port }}"
tls="on"
tls.caCert="{{ rsyslog_certificate_ca_path }}"
tls.myCert="{{ rsyslog_certificate_path }}"
tls.myPrivKey="{{ rsyslog_certificate_key_path }}"
tls.authMode="name"
tls.permittedPeer="{{ rsyslog_target }}"
{% else %}
port="{{ rsyslog_relp_port }}"
{% endif %}
queue.type="LinkedList"
queue.size="{{ rsyslog_queue_size }}"
queue.filename="q_forward"
queue.saveOnShutdown="on"
queue.maxDiskSpace="{{ rsyslog_queue_max_disk_space }}"
action.resumeRetryCount="-1"
action.resumeInterval="10"
action.reportSuspension="on"
action.reportSuspensionContinuation="on")
}
{% endif %}
|
