<!--# this is a sample of what an Apache-like rsyslog.conf could look like
# note that order of appearance is no longer important (technically, this
# requires multiple parsing stages, but that's OK - it is a one time
# effort and does not contribute to runtime performance) -->

<rsyslog_conf version="1">

<global
	emitstartupmessages="off"
/>

<!-- this loads the module -->
<!-- note that inline comments are NOT possible -->
<module id="imtcp"
	binary="imtcp"
	maxlisten="512"
/>

<!-- a somewhat verbose form -->
<input type="imtcp">
	<!-- params holds module-specific config parameters -->
	<params
		listen="10514"
		ruleset="remote10514"
	/>
</input>

<!-- sample for the most condensed form -->
<input type="imtcp"><params listen="10515" ruleset="remote10515" /> </input>

<ruleset id="remote10514">
	<rule>
		<!-- no filter specified -> all messages! -->
		<action type="omfile">
			<params file="/var/log/catchall" />
		</action>
		<action use="dynfile" /> <!-- use action defined elsewhere -->
	</rule>
</ruleset>

<template id="dynGen" format="/var/log/%fromhost%.log" />

<!-- this is a "stand-alone" action, to be used in more than one rule -->
<action id="dynfile" type="omfile">
	<template format="%msg%\n" />
	<params filetemplate="dynGen" />
</action>

<ruleset id="remote10514">
	<rule>
		<filter pri="mail.*" />
		<action type="omfile">
			<params file="/var/log/remote10514" />
		</action>
		<action execonlyonce="5sec">
			<params target="192.168.1.2:514" protocol="udp" />
		</action>
		<action use="dynfile" />
	</rule>
	<rule>
		<filter previousfailed="yes" />
		<action type="omfwd">
			<params target="192.168.1.3:514" protocol="udp" />
		</action>
	</rule>
	<rule>
		<filter expr="$severity == 'error' and $msg contains 'Link 2'" />
		<action type="ommail">
			<!-- xml escaping is sometimes ugly (see subject!) -->
			<params server="192.168.1.3"
				from="someone@example.net"
				to="ops@example.net"
				subject="###error &quot;detected&quot;###"
				/>
		</action>
	</rule>
</ruleset>
</rsyslog_conf>
