Configuration — rsyslog 8.2502.0 documentation

# Configuration

Rsyslog Configuration Reference Manual Introduction

This document serves as a detailed guide to rsyslog configuration, offering extensive information on the setup and management of system logging using rsyslog It covers various aspects of rsyslog configuration, including constructs, statements, and key concepts, designed to assist users in customizing their logging infrastructure according to specific needs.

The primary configuration file for rsyslog, located at /etc/rsyslog.conf, acts as the central point for establishing logging rules. This file is used to define input modules, filters, actions, and global directives, facilitating the processes of log collection, filtering, routing, and formatting.

Please note that this documentation is currently in the process of being refined to improve its clarity, structure, and accessibility. We value your patience and understanding during this phase and are committed to delivering a comprehensive and easy-to-navigate guide to rsyslog.

For further exploration of rsyslog’s configuration intricacies, please refer to the links provided below. This manual is designed to be a valuable resource for both experienced system administrators and those new to the field, aiming to fully leverage the capabilities of rsyslog.

Note that configurations can be built interactively via the online rsyslog configuration builder tool.

- Configuration Formats
  - Which Format Should I Use?
  - Conclusion
- Converting older formats to `advanced`
  - Do not overdo conversion
  - Converting Module Load
  - Converting Actions
  - Action with Multiple Parameters
  - Converting Action Chains
- sysklogd format
  - DESCRIPTION
  - SELECTORS
  - ACTIONS
  - EXAMPLES
  - CONFIGURATION FILE SYNTAX DIFFERENCES
  - BUGS
- Basic Structure
  - Quick overview of message flow and objects
  - Processing Principles
  - Configuration File
  - Statement Types
  - Comments
  - Processing Order
  - Inputs
  - Outputs
  - Rulesets and Rules
- Templates
  - Description
  - Template processing
  - The template() object
  - Examples
  - The LEGACY $template statement
- rsyslog Properties
  - Message Properties
  - System Properties
- The Property Replacer
  - Accessing Properties
  - Further Links
- Filter Conditions
  - Selectors
  - Property-Based Filters
  - Expression-Based Filters
  - BSD-style Blocks
  - Examples
- RainerScript
  - Data Types
  - Expressions
  - Functions
  - Control Structures
  - configuration objects
  - String Constants
  - Variable (Property) types
  - Lookup Tables
  - General Queue Parameters
  - The rsyslog “call” statement
  - The rsyslog “call_indirect” statement
  - global() configuration object
  - The rsyslog include() object
- Actions
  - General Action Parameters
  - Useful Links
  - Legacy Format
- Input
  - General Input Parameters
- Parser
  - General Parser Parameters
  - Samples
- timezone
  - Parameters
  - Sample
- Examples
  - Templates
  - Selector lines
- Legacy Configuration Directives
  - Configuration Parameter Types
  - Legacy Global Configuration Statements
  - Legacy Directives affecting Input Modules
  - Legacy Action-Specific Configuration Statements
  - Ruleset-Specific Legacy Configuration Statements
- rsyslog statistic counter
  - Queue
  - Actions
  - Plugins
- Modules
  - Output Modules
  - Input Modules
  - Parser Modules
  - Message Modification Modules
  - String Generator Modules
  - Library Modules
  - Where are the modules integrated into the Message Flow?
- Output Channels
- Dropping privileges in rsyslog
- Notes on IPv6 Handling in Rsyslog
- libgcrypt Log Crypto Provider (gcry)
- libossl Log Crypto Provider (ossl)
- Dynamic Stats
  - Dyn-stats configuration
  - Reporting
- Lookup Tables
  - Types
  - Lookup Table File Format
  - Lookup-table configuration
  - Implementation Details
- Percentile Stats
  - Percentile Stats Configuration
  - Reporting

Configuration file examples can be found in the rsyslog wiki. Also keep the rsyslog config snippets on your mind. These are ready-to-use real building blocks for rsyslog configuration.

There is also one sample file provided together with the documentation set. If you do not like to read, be sure to have at least a quick look at `rsyslog-example.conf`.

While rsyslogd contains enhancements over standard syslogd, efforts have been made to keep the configuration file as compatible as possible. While, for obvious reasons, enhanced features require a different config file syntax, rsyslogd should be able to work with a standard syslog.conf file. This is especially useful while you are migrating from syslogd to rsyslogd.

See also

Help with configuring/using `Rsyslog`:

- Mailing list - best route for general questions

- GitHub: rsyslog source project - detailed questions, reporting issues that are believed to be bugs with `Rsyslog`

See also

Contributing to `Rsyslog`:

- Source project: rsyslog project README.

- Documentation: rsyslog-doc project README

Copyright 2008-2023 Rainer Gerhards (Großrinderfeld), and Others.