c6360e6763
- add rc.d script and user _rsyslogd - add rsyslog modules elasticsearch and normaliz - builds now on i386 without -march=i686 - no patches needed anymore ok sthen@ danj@
97 lines
3.4 KiB
Plaintext
97 lines
3.4 KiB
Plaintext
# $OpenBSD: rsyslog.conf,v 1.2 2018/03/12 17:42:08 remi Exp $
|
|
|
|
# rsyslog configuration file
|
|
# note that most of this config file uses old-style format,
|
|
# because it is well-known AND quite suitable for simple cases
|
|
# like we have with the default config. For more advanced
|
|
# things, RainerScript configuration is suggested.
|
|
#
|
|
# For more information see http://www.rsyslog.com/doc/rsyslog_conf.html
|
|
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
|
|
|
|
#### MODULES ####
|
|
|
|
module(load="imuxsock") # provides support for local system logging (e.g. via logger command)
|
|
# on OpenBSD sendsyslog(2) is used for logging - imklog will not receive logs
|
|
#module(load="imklog") # provides kernel logging support (previously done by rklogd)
|
|
#module(load"immark") # provides --MARK-- message capability
|
|
|
|
# Provides UDP syslog reception
|
|
# for parameters see http://www.rsyslog.com/doc/imudp.html
|
|
#module(load="imudp") # needs to be done just once
|
|
#input(type="imudp" port="514")
|
|
|
|
# Provides TCP syslog reception
|
|
# for parameters see http://www.rsyslog.com/doc/imtcp.html
|
|
#module(load="imtcp") # needs to be done just once
|
|
#input(type="imtcp" port="514")
|
|
|
|
|
|
#### GLOBAL DIRECTIVES ####
|
|
|
|
# Use default timestamp format
|
|
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
|
|
|
|
# File syncing capability is disabled by default. This feature is usually not required,
|
|
# not useful and an extreme performance hit
|
|
#$ActionFileEnableSync on
|
|
|
|
# Include all config files in /etc/rsyslog.d/
|
|
$IncludeConfig ${SYSCONFDIR}/rsyslog.d/*.conf
|
|
|
|
# Drop root privileges
|
|
# See http://wiki.rsyslog.com/index.php/Security#Dropping_Privileges
|
|
$PrivDropToUser _rsyslogd
|
|
$PrivDropToGroup _rsyslogd
|
|
|
|
#### RULES ####
|
|
|
|
*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/messages
|
|
|
|
kern.debug;syslog,user.info /var/log/messages
|
|
|
|
auth.info /var/log/authlog
|
|
|
|
authpriv.debug /var/log/secure
|
|
|
|
cron.info /var/cron/log
|
|
|
|
daemon.info /var/log/daemon
|
|
|
|
ftp.info /var/log/xferlog
|
|
|
|
lpr.debug /var/log/lpd-errs
|
|
|
|
mail.info /var/log/maillog
|
|
|
|
# Uncomment this to have all messages of notice level and higher
|
|
# as well as all authentication messages sent to root.
|
|
#*.notice;auth.debug root
|
|
|
|
# Everybody gets emergency messages
|
|
*.emerg :omusrmsg:*
|
|
|
|
#uucp,news.crit /var/log/uucp
|
|
|
|
# Uncomment this line to send "important" messages to the system
|
|
# console: be aware that this could create lots of output.
|
|
#*.err;auth.notice;authpriv.none;kern.debug;mail.crit /dev/console
|
|
|
|
# ### begin forwarding rule ###
|
|
# The statement between the begin ... end define a SINGLE forwarding
|
|
# rule. They belong together, do NOT split them. If you create multiple
|
|
# forwarding rules, duplicate the whole block!
|
|
# Remote Logging (we use TCP for reliable delivery)
|
|
#
|
|
# An on-disk queue is created for this action. If the remote host is
|
|
# down, messages are spooled to disk and sent when it is up again.
|
|
#$WorkDirectory /var/lib/rsyslog # where to place spool files
|
|
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
|
|
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
|
|
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
|
|
#$ActionQueueType LinkedList # run asynchronously
|
|
#$ActionResumeRetryCount -1 # infinite retries if host is down
|
|
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
|
|
#*.* @@remote-host:514
|
|
# ### end of the forwarding rule ###
|