<rsyslog_conf version="1">
re-written example by David Lang

<global
 	emitstartupmessages="off"
/>

<module id="imtcp"
 	binary="imtcp"
 	maxlisten="512"
/>

<imtcp listen="10515" ruleset="remote10515" />

<ruleset id="remote10514">
 	<rule>
 		<omfile file="/var/log/catchall" />
 		<action use="dynfile" /> <!-- use action defined elsewhere -->
 	</rule>
</ruleset>

<template id="dynGen" format="/var/log/%fromhost%.log" />

<action id="dynfile">
    this is a "stand-alone" action, to be used in more than one rule
         <omfile format="%msg%\n" filetemplate="dynGen" />
</action>

<ruleset id="remote10514">
 	<rule pri="mail.*" >
 		<omfile file="/var/log/remote10514" />
 		<action use="dynfile" />
 	</rule>
 	<rule pri="mail.*" execonlyonce="5sec">
 		<udpfwd target="192.168.1.2:514" />
 	</rule>
 	<rule previousfailed="yes" >
 		<udpfwd target="192.168.1.3:514" />
 	</rule>
 	<rule expr="$severity == 'error' and $msg contains 'Link 2'" >
 		<ommail server="192.168.1.3"
 				from="someone@example.net"
 				to="ops@example.net"
 				subject="###error &quot;detected&quot;###"
 				/>
 	</rule>
</ruleset>
</rsyslog_conf>

