# rsyslog v8 configuration file
#
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# Problems?  http://www.rsyslog.com/doc/troubleshoot.html
#
# Derived from
# https://cgit.freebsd.org/src/tree/usr.sbin/syslogd/syslog.conf

#### MODULES =====================================================
#
module(load="immark" interval="3600")   # Write MARK messages hourly
module(load="imuxsock") # Local system logging (logger, etc)
module(load="imklog")   # Kernel logging (previously done by rklogd)

#module(load="imudp")    # Provides UDP syslog reception
#$UDPServerRun 514

#module(load="imtcp")    # Provides TCP syslog reception
#$InputTCPServerRun 514

#### GLOBAL DIRECTIVES ===========================================

# Enable rsyslogd writing all mark messages
$ActionWriteAllMarkMessages on
:programname, isequal, "rsyslogd"

# Use short timestamp format
## $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ActionFileDefaultTemplate ShortForm

# Use high-precision timestamps and timezone information
## $ActionFileDefaultTemplate RSYSLOG_FileFormat

# File syncing capability is disabled by default.  This feature is
# usually not required, not useful and an extreme performance hit
## $ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

#### TEMPLATES ===================================================

$template DYNauth,"/var/log/%$YEAR%/%$MONTH%%$DAY%/secure"
$template DYNcron,"/var/log/%$YEAR%/%$MONTH%%$DAY%/cron"
$template DYNdaemon,"/var/log/%$YEAR%/%$MONTH%%$DAY%/daemon"
$template DYNdebug,"/var/log/%$YEAR%/%$MONTH%%$DAY%/debug.log"
$template DYNfirewall,"/var/log/%$YEAR%/%$MONTH%%$DAY%/firewall"
$template DYNkern,"/var/log/%$YEAR%/%$MONTH%%$DAY%/kernlog"
$template DYNmail,"/var/log/%$YEAR%/%$MONTH%%$DAY%/maillog"
$template DYNntp,"/var/log/%$YEAR%/%$MONTH%%$DAY%/ntplog"
$template DYNsyslog,"/var/log/%$YEAR%/%$MONTH%%$DAY%/syslog"

$template DYNlocal0,"/var/log/%$YEAR%/%$MONTH%%$DAY%/local0log"
$template DYNlocal1,"/var/log/%$YEAR%/%$MONTH%%$DAY%/local1log"
$template DYNlocal2,"/var/log/%$YEAR%/%$MONTH%%$DAY%/local2log"
$template DYNlocal3,"/var/log/%$YEAR%/%$MONTH%%$DAY%/local3log"
$template DYNlocal4,"/var/log/%$YEAR%/%$MONTH%%$DAY%/local4log"
$template DYNlocal5,"/var/log/%$YEAR%/%$MONTH%%$DAY%/local5log"
$template DYNlocal6,"/var/log/%$YEAR%/%$MONTH%%$DAY%/local6log"
$template DYNlocal7,"/var/log/%$YEAR%/%$MONTH%%$DAY%/local7log"

# This is identical to traditional format, without the hostname.
$template ShortForm,"%timegenerated% %syslogtag%%msg%\n"

#### FILTERS =====================================================

# This apparently comes from Radeon fence code in the kernel.
#:msg, contains, " armed on ring " ~
#:msg, contains, " signaled from irq context" ~
#:msg, contains, " pending" ~
#:msg, contains, "alloc_contig_range:" ~

#### RULES =======================================================

# Tried setting proper permissions for all directories and files:
###  action(type="omfile" dirCreateMode="0750" FileCreateMode="0640"
###      dynafile="DYNauth")
# Unfortunately, this creates duplicate entries just about everywhere.

# ----------------------------------------------------------------
# Log connection drops to firewall log.

if ($syslogfacility-text == 'kern') then {
    if $msg contains 'Connection attempt' then {
        ?DYNfirewall
    } else {
        ?DYNkern
    }
    stop
}

# ----------------------------------------------------------------
# Daemon messages.

if ($syslogfacility-text == 'daemon') then {
    ?DYNdaemon
    stop
}

# ----------------------------------------------------------------
# NTP.

if ($syslogfacility-text == 'ntp') then {
    ?DYNntp
    stop
}

# ----------------------------------------------------------------
# Log all the mail messages in one place. Postfix stuff must be ID'd
# by looking at the message contents; this has to come before general
# processing so we can discard the message, or postfix entries are
# also logged to "syslog".

if ($syslogfacility-text == 'mail') then {
    ?DYNmail
    stop
}

# ----------------------------------------------------------------
# The auth and security files have restricted access.
## authpriv.*     /var/log/secure
## auth.*         /var/log/secure
## security.*     /var/log/secure

if ($syslogseverity <= '6') then {
    if ($syslogfacility-text == 'auth' or
        $syslogfacility-text == 'authpriv' or
        $syslogfacility-text == 'security')
    then {
        ?DYNauth
        stop
    }
}

# ----------------------------------------------------------------
# Log cron stuff
## cron.*          /var/log/cron

if ($syslogseverity <= '6' and
    $syslogfacility-text == 'cron') then {
    ?DYNcron
    stop
}

# ----------------------------------------------------------------
# Local logs; local6=snapshots, local7=zfs vdev

if ($syslogseverity <= '6') then {
    if ($syslogfacility-text startswith 'local') then {
        if ($syslogfacility-text == 'local0') then ?DYNlocal0
        if ($syslogfacility-text == 'local1') then ?DYNlocal1
        if ($syslogfacility-text == 'local2') then ?DYNlocal2
        if ($syslogfacility-text == 'local3') then ?DYNlocal3
        if ($syslogfacility-text == 'local4') then ?DYNlocal4
        if ($syslogfacility-text == 'local5') then ?DYNlocal5
        if ($syslogfacility-text == 'local6') then ?DYNlocal6
        if ($syslogfacility-text == 'local7') then ?DYNlocal7
        stop
    }
}

# ----------------------------------------------------------------
# MAIN SYSLOG: put this last, since most other messages stop by now.
# Log info or above in syslog, below in debug.log -- don't put
# security or authorization messages anywhere except authlog!
#
## authpriv.none;auth.none;kern.none;cron.none;local5.none;*.info
##     /var/log/syslog

if ($syslogfacility-text != 'auth'     and
    $syslogfacility-text != 'authpriv' and
    $syslogfacility-text != 'cron'     and
    $syslogfacility-text != 'kern'     and
    $syslogfacility-text != 'mail'     and
    $syslogfacility-text != 'security' and
    $programname != "devd") then {
    if ($syslogseverity <= '6') then {
        ?DYNsyslog
    } else {
        ?DYNdebug
    }
}

#### EOF =========================================================
