# this is a sample of what an Apache-like rsyslog.conf could look like
# note that order of appearance is no longer important (technically, this
# requires multiple parsing stages, but that's OK -- it is a one time
# effort and does not contribute to runtime performance)

<global>
	emitstartupmessages off
</global>

# this loads the module
<module imtcp>
	binary imtcp #inline comment
	maxlisten 512
</module>

# a somewhat verbose form
<input>
	type imtcp
	<params> #params holds module-specific config parameters
		listen 10514
		ruleset remote10514
	</params>
</input>

# sample for the most condensed form
<input><params>listen 10515; ruleset remote10515</params></input>

<ruleset remote10514>
	<rule>
		# no filter specified --> all messages!
		<action>
			type omfile
			<params>
				file /var/log/catchall
			</params>
		</action>
		<action use=dynfile />
	</rule>
</ruleset>

<template dynGen>
	format "/var/log/%fromhost%.log"
</template>

# this is a "stand-alone" action, to be used in more than one rule
<action dynfile>
	type omfile
	<template>
		format "%msg%\n"
	</template>
	<params>
		filetemplate dynGen
	</params>
</action>

<ruleset remote10514>
	<rule>
		<filter>pri mail.*;</filter> # condensed form
		<action>
			type omfile
			<params>
				file /var/log/remote10514
			</params>
		</action>
		<action>
			execonlyonce 5sec  
			<params>
				target 192.168.1.2:514
				protocol udp
			</params>
		</action>
		<action use=dynfile />
	</rule>
	<rule>
		<filter>
			previousfailed on # execonlyifprevsuspended
		</filter>
		<action>
			type omfwd
			<params>
				target 192.168.1.3:514
				protocol udp
			</params>
		</action>
	</rule>
	<rule>
		<filter>
			expr $severity == 'error' and $msg contains 'Link 2'
		</filter>
		<action>
			<params>
				server 192.168.1.3
				from someone@example.net
				to ops@example.net
				# words with spaces need to go between quotes, with the
				# usual escaping in place
				subject "###error \"detected\"###"
			</params>
		</action>
	</rule>
</ruleset>