/etc/rsyslog.d/client.conf

# This file is managed by Puppet, changes may be overwritten

# Change rate limiting to allow for things like updates traffic to swamp to loghost.
$SystemLogRateLimitInterval 5
$SystemLogRateLimitBurst 3000

# An "In-Memory Queue" is created for remote logging.
$WorkDirectory /var/lib/rsyslog    # where to place spool files
$ActionQueueFileName queue      # unique name prefix for spool files
$ActionQueueMaxDiskSpace 2g     # spool space limit (use as much as possible)
$ActionQueueSaveOnShutdown on   # save messages to disk on shutdown
$ActionQueueType LinkedList     # run asynchronously
$ActionResumeRetryCount -1      # infinety retries if host is down

# Use high precision timestamp format.
$ActionFileDefaultTemplate RSYSLOG_FileFormat

# Setup SSL connection.
# CA/Cert
$DefaultNetStreamDriverCAFile /var/lib/puppet/ssl/certs/www1.drupal.org.pem

# Connection settings.
$DefaultNetstreamDriver gtls
$ActionSendStreamDriverMode 1
$ActionSendStreamDriverAuthMode anon

# Log to remote syslog server using tcp
*.* @@loghost.drupal.org:514;RSYSLOG_ForwardFormat
# Logging locally.

# Log auth messages locally
auth,authpriv.*                 /var/log/secure
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.*                                                 /var/log/kern.log

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# Log all the mail messages in one place.
mail.*                         -/var/log/maillog


# Log cron stuff
cron.*                         /var/log/cron

# Everybody gets emergency messages
*.emerg                         *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                 -/var/log/spooler

# Save boot messages also to boot.log
local7.*                       -/var/log/boot.log