# /etc/rsyslog.conf Configuration file for rsyslog (RainerScript format)
# For more information see rsyslog.conf (5) manpage or http://www.rsyslog.com/doc/v8-stable/configuration/index.html


###########################
#### GLOBAL DIRECTIVES ####
###########################

global(
    umask="0022"
    abortOnUncleanConfig="on"
    compatibility.defaults.secure="strict"

    # Where to place spool files (uncomment if using remote logging queue)
    # workDirectory="/rsyslog/spool"
)

# Include all config files in /etc/rsyslog.d/
# include(file="/etc/rsyslog.d/*.conf")


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
module(load="imklog" consoleLogLevel="3") # provides kernel logging support
module(load="immark")   # provides --MARK-- message capability

# Module omfile avec la gestion du format et des permissions par défaut
module(
    load="builtin:omfile"
    Template="RSYSLOG_TraditionalFileFormat"
    FileOwner="root"
    FileGroup="root"
    FileCreateMode="0640"
    DirCreateMode="0755"
)

# ######### Receiving Messages from Remote Hosts ##########
# TCP Syslog Server:
# module(load="imtcp")
# input(type="imtcp" port="514")

# UDP Syslog Server:
# module(load="imudp")
# input(type="imudp" port="514")


###############
#### RULES ####
###############

# Uncomment this to see kernel messages on the console.
# if ($syslogfacility-text == "kern") then {
#     action(type="omfile" file="/dev/console")
# }

# Log anything 'info' or higher, but lower than 'warn'.
# Exclude authpriv, cron, mail, and news.
if ($syslogseverity <= 6 and $syslogseverity > 4) and \
   ($syslogfacility-text != "authpriv") and \
   ($syslogfacility-text != "cron") and \
   ($syslogfacility-text != "mail") and \
   ($syslogfacility-text != "news") then {
    action(type="omfile" file="/var/log/messages" Sync="off")
}

# Log anything 'warn' or higher.
# Exclude authpriv, cron, mail, and news.
if ($syslogseverity <= 4) and \
   ($syslogfacility-text != "authpriv") and \
   ($syslogfacility-text != "cron") and \
   ($syslogfacility-text != "mail") and \
   ($syslogfacility-text != "news") then {
    action(type="omfile" file="/var/log/syslog" Sync="off")
}

# Debugging information is logged here.
if ($syslogseverity == 7) then {
    action(type="omfile" file="/var/log/debug" Sync="off")
}

# Private authentication message logging:
if ($syslogfacility-text == "authpriv") then {
    action(type="omfile" file="/var/log/secure" Sync="off")
}

# Cron related logs:
if ($syslogfacility-text == "cron") then {
    action(type="omfile" file="/var/log/cron" Sync="off")
}

# Mail related logs:
if ($syslogfacility-text == "mail") then {
    action(type="omfile" file="/var/log/maillog" Sync="off")
}

# Emergency level messages go to all users:
if ($syslogseverity == 0) then {
    action(type="omusrmsg" users="*")
}

# This log is for news and uucp errors:
if ($syslogfacility-text == "uucp") or \
   ($syslogfacility-text == "news" and $syslogseverity <= 2) then {
    action(type="omfile" file="/var/log/spooler" Sync="off")
}

# Uncomment these if you'd like INN to keep logs on everything.
# if ($syslogfacility-text == "news" and $syslogseverity == 2) then {
#     action(type="omfile" file="/var/log/news/news.crit" Sync="off")
# }
# if ($syslogfacility-text == "news" and $syslogseverity == 3) then {
#     action(type="omfile" file="/var/log/news/news.err" Sync="off")
# }
# if ($syslogfacility-text == "news" and $syslogseverity == 5) then {
#     action(type="omfile" file="/var/log/news/news.notice" Sync="off")
# }

# ########## Remote Logging (we use TCP for reliable delivery) ##########
# action(
#     type="omfwd"
#     target="remote-host"
#     port="514"
#     protocol="tcp"
#     streamdriver.mode="0"
#     queue.filename="uniqName"
#     queue.maxdiskspace="1g"
#     queue.saveonshutdown="on"
#     queue.type="LinkedList"
#     action.resumeRetryCount="-1"
# )