<?xml version="1.0"?>
<!--DOCTYPE config SYSTEM "config-v00.dtd"-->
<config application="rsyslog" version="1" YYYY-MM-DD="2010-06-21">

<!--# this is a sample of what a XML rsyslog.conf could look like.
  In this sample, we do not use attributes but parameters for most
  cases.
# note that order of appearance is no longer important (technically, this
# requires multiple parsing stages, but that's OK - it is a one time
# effort and does not contribute to runtime performance) -->


<global>
	<param name="emitstartupmessages">off</param>
</global>

<!-- this loads the module -->
<!-- note that inline comments are NOT possible -->
<module id="imtcp">
	<param name="binary">imtcp</param>
	<param name="maxlisten">512</param>
</module>

<!-- a somewhat verbose form -->
<input type="imtcp">
	<!-- params holds module-specific config parameters -->
	<param name="listen">10514</param>
	<param name="ruleset">remote10514</param>
</input>

<!-- sample for the most condensed form ** not practical for this conf format -->
<input type="imtcp"><param name="listen">10515</param><param name="ruleset">remote10515</param></input>

<ruleset id="remote10514">
	<rule>
		<!-- no filter specified -> all messages! -->
		<action type="omfile">
			<param name="file">/var/log/catchall</param>
			<param name="sync">on</param>
		</action>
		<action use="dynfile" /> <!-- use action defined elsewhere -->
	</rule>
</ruleset>

<template id="dynGen">
	<param name="format">/var/log/%fromhost%.log</param>
</template>

<!-- this is a "stand-alone" action, to be used in more than one rule -->
<action id="dynfile" type="omfile">
	<template>
		<param name="format">%msg%\n</param>
	</template>
	<param name="filetemplate">dynGen</param>
</action>

<ruleset id="remote10514">
	<rule>
		<filter>
			<param name="pri">mail.*</param>
			<param name="execonlyonce">5sec</param>
		</filter>
		<action type="omfile">
			<param name="file">/var/log/remote10514</param>
		</action>
		<action type="omfwd">
			<param name="target">192.168.1.2:514</param>
			<param name="protocol">udp</param>
		</action>
		<action use="dynfile" />
	</rule>
	<rule>
		<filter>
			<param name="previousfailed">yes</param>
		</filter>
		<action type="omfwd">
			<param name="target">192.168.1.3:514</param>
			<param name="protocol">udp</param>
		</action>
	</rule>
	<rule>
		<filter>
			<param name="expr">$severity == 'error' and $msg contains 'Link 2'</param>
		</filter>
		<action type="ommail">
			<param name="server">192.168.1.3</param>
			<param name="from">someone@example.net</param>
			<param name="to">ops@example.net</param>
			<param name="subject">###error "detected"###</param>
		</action>
	</rule>
</ruleset>
</config>
