# if you experience problems, check
# http://www.rsyslog.com/troubleshoot for assistance

# rsyslog v3: load input modules
# If you do not load inputs, nothing happens!
# You may need to set the module load path if modules are not found.

$ModLoad immark.so # provides --MARK-- message capability
$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so # kernel logging (formerly provided by rklogd)

# ######### Receiving Messages from Remote Hosts ##########
# TCP Syslog Server:
# provides TCP syslog reception and GSS-API (if compiled to support it)
$ModLoad imtcp.so  # load module
$InputTCPServerRun 514 # start up TCP listener at port 514

# UDP Syslog Server:
$ModLoad imudp.so  # provides UDP syslog reception
$UDPServerRun 514 # start a UDP syslog server at standard port 514

$DirCreateMode 0755
$FileCreateMode 0644


$ModLoad ommysql

$WorkDirectory /opt/applis/rsyslog/work # default location for work (spool) files

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName dbq    # set file name, also enables disk mode
$ActionResumeRetryCount -1  # infinite retries on insert failure


# Filter  for web-acp-1 ED Application

$template df_admin_ed_application_message_acp_log,"/opt/data/log/syslog/enterprise-directory/ACP/%$YEAR%/%$MONTH%/%$DAY%/messages.log"
if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'Referential' or $msg contains 'Directory' or $msg contains 'Execute batch URL') then ?df_admin_ed_application_message_acp_log


$template df_admin_ed_application_errors_acp_log,"/opt/data/log/syslog/enterprise-directory/ACP/%$YEAR%/%$MONTH%/%$DAY%/errors.log"
if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'Referential' or $msg contains 'Directory' or $msg contains 'Execute batch URL') then ?df_admin_ed_application_errors_acp_log

if $HOSTNAME == 'web-acp-1' and ($syslogtag contains 'Enterprise-Directory_Apache-[ERROR]' or $syslogtag contains 'Referential-CMD_Apache-[ERROR]' or $syslogtag contains 'Referential-LMD_Apache-[ERROR]' ) then ?df_admin_ed_application_errors_acp_log

# MySQL ACP ED
if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'Referential' or $msg contains 'Directory' or $msg contains 'Execute batch URL') then :ommysql:172.26.3.68,logs_web-acp-1-ED,rsyslog,XfNkHeb3
if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'Referential' or $msg contains 'Directory' or $msg contains 'Execute batch URL') then :ommysql:172.26.3.68,logs_web-acp-1-ED,rsyslog,XfNkHeb3
if $HOSTNAME == 'web-acp-1' and ($syslogtag contains 'Enterprise-Directory_Apache-[ERROR]' or $syslogtag contains 'Referential-CMD_Apache-[ERROR]' or $syslogtag contains 'Referential-LMD_Apache-[ERROR]' ) then :ommysql:172.26.3.68,logs_web-acp-1-ED,rsyslog,XfNkHeb3



# Filter for web-acp-1 VTD Application

$template df_admin_vtd_application_message_acp_log,"/opt/data/log/syslog/technical-directory/ACP/%$YEAR%/%$MONTH%/%$DAY%/messages.log"
if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'VTDS' or $msg contains 'certificate_management' or $msg contains 'authentication_service' or $msg contains 'IPS SYNC') then ?df_admin_vtd_application_message_acp_log

$template df_admin_vtd_application_errors_acp_log,"/opt/data/log/syslog/technical-directory/ACP/%$YEAR%/%$MONTH%/%$DAY%/errors.log"
if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'VTDS' or $msg contains 'certificate_management' or $msg contains 'authentication_service' or $msg contains 'IPS SYNC') then ?df_admin_vtd_application_errors_acp_log

if $HOSTNAME == 'web-acp-1' and ($syslogtag contains 'authentication_service_Apache-[ERROR]' or $syslogtag contains 'certificate_management_Apache-[ERROR]' or $syslogtag contains 'VTDS_Apache-[ERROR]') then ?df_admin_vtd_application_errors_acp_log

## MySQL ACP VTD
if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'VTDS' or $msg contains 'certificate_management' or $msg contains 'authentication_service' or $msg contains 'IPS SYNC') then :ommysql:172.26.3.68,logs_web-acp-1-VTD,rsyslog,XfNkHeb3
if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'VTDS' or $msg contains 'certificate_management' or $msg contains 'authentication_service' or $msg contains 'IPS SYNC') then :ommysql:172.26.3.68,logs_web-acp-1-VTD,rsyslog,XfNkHeb3
if $HOSTNAME == 'web-acp-1' and ($syslogtag contains 'authentication_service_Apache-[ERROR]' or $syslogtag contains 'certificate_management_Apache-[ERROR]' or $syslogtag contains 'VTDS_Apache-[ERROR]') then :ommysql:172.26.3.68,logs_web-acp-1-VTD,rsyslog,XfNkHeb3



# Filter for web-acp-1 VTD for backup
$template df_admin_vtd_application_message_acp_for_backup_log,"/opt/data/log/backup/technical-directory/ACP/%$YEAR%/%$MONTH%/%$DAY%/messages.log"

if $HOSTNAME == 'web-acp-1' and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'OpenSSO' or $msg contains 'Provisioning batch' or $msg contains 'IPS SYNC') then ?df_admin_vtd_application_message_acp_for_backup_log



# Filter for web(1,2)-apps ED Application


$template df_admin_ed_application_errors_apps_log,"/opt/data/log/syslog/enterprise-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/errors.log"
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and ($syslogtag contains 'Enterprise-Directory_Apache-\[ERROR\]' or $syslogtag contains 'Referential-CMD_Apache-\[ERROR\]' or $syslogtag contains 'Referential-LMD_Apache-\[ERROR\]' ) and not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' or $msg contains 'bytes of entropy') then ?df_admin_ed_application_errors_apps_log

$template df_admin_ed_application_message_apps_log,"/opt/data/log/syslog/enterprise-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/messages.log"
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so')  and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'Referential' or $msg contains 'Directory' or $msg contains 'Execute batch URL') and not ($msg contains 'bytes of entropy' or $msg contains 'ERROR' or $syslogtag contains 'ERROR') then ?df_admin_ed_application_message_apps_log

if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so.apps')  and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'Referential' or $msg contains 'Directory' or $msg contains 'Execute batch URL') then ?df_admin_ed_application_errors_apps_log

if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and ($syslogtag contains 'Enterprise-Directory_Apache_Rewrite' or $syslogtag contains 'Enterprise-Directory_Apache' or $syslogtag contains 'Referential-CMD_Apache' or $syslogtag contains 'Referential-LMD_Apache'  or $syslogtag contains 'Referential-CMD_Apache_Rewrite'  or $syslogtag contains 'Referential-LMD_Apache_Rewrite') and not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' or $msg contains 'bytes of entropy' or $msg contains 'ERROR' or $syslogtag contains 'ERROR') then ?df_admin_ed_application_message_apps_log

## MySQL APPS ED
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and ($syslogtag contains 'Enterprise-Directory_Apache-\[ERROR\]' or $syslogtag contains 'Referential-CMD_Apache-\[ERROR\]' or $syslogtag contains 'Referential-LMD_Apache-\[ERROR\]' ) and not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' or $msg contains 'bytes of entropy') then :ommysql:172.26.3.68,logs_web-apps-ED,rsyslog,XfNkHeb3
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so')  and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'Referential' or $msg contains 'Directory' or $msg contains 'Execute batch URL') and not ($msg contains 'bytes of entropy' or $msg contains 'ERROR' or $syslogtag contains 'ERROR') then :ommysql:172.26.3.68,logs_web-apps-ED,rsyslog,XfNkHeb3
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so.apps')  and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'Referential' or $msg contains 'Directory' or $msg contains 'Execute batch URL') then :ommysql:172.26.3.68,logs_web-apps-ED,rsyslog,XfNkHeb3
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and ($syslogtag contains 'Enterprise-Directory_Apache_Rewrite' or $syslogtag contains 'Enterprise-Directory_Apache' or $syslogtag contains 'Referential-CMD_Apache' or $syslogtag contains 'Referential-LMD_Apache'  or $syslogtag contains 'Referential-CMD_Apache_Rewrite'  or $syslogtag contains 'Referential-LMD_Apache_Rewrite') and not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' or $msg contains 'bytes of entropy' or $msg contains 'ERROR' or $syslogtag contains 'ERROR') then :ommysql:172.26.3.68,logs_web-apps-ED,rsyslog,XfNkHeb3



$template df_admin_ed_application_cron_message_apps_log,"/opt/data/log/syslog/enterprise-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/cron_messages.log"
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so')  and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'Execute batch URL') then ?df_admin_ed_application_cron_message_apps_log

$template df_admin_ed_application_cron_errors_apps_log,"/opt/data/log/syslog/enterprise-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/cron_errors.log"
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so')  and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'Execute batch URL') then ?df_admin_ed_application_cron_errors_apps_log



# Filter for web(1,2)-apps VTD Application 

$template df_admin_vtd_application_errors_apps_log,"/opt/data/log/syslog/technical-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/errors.log"
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'VTDS' or $msg contains 'lost_password' or $msg contains 'certificate_management' or $msg contains 'authentication_service' or $msg contains 'OpenSSO' or $msg contains 'Provisioning batch' or $msg contains 'IPS SYNC') and  not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' or $msg contains 'bytes of entropy') then ?df_admin_vtd_application_errors_apps_log


$template df_admin_vtd_application_message_apps_log,"/opt/data/log/syslog/technical-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/messages.log"
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'VTDS' or $msg contains 'lost_password' or $msg contains 'certificate_management' or $msg contains 'authentication_service' or $msg contains 'OpenSSO' or $msg contains 'Provisioning batch' or $msg contains 'IPS SYNC')  and not ($msg contains 'bytes of entropy' or $msg contains 'ERROR' or $syslogtag contains 'ERROR') then ?df_admin_vtd_application_message_apps_log

$template df_admin_vtd_application_cron_message_apps_log,"/opt/data/log/syslog/technical-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/cron_messagand $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'Provisioning batch' or $msg contains 'Sync IPS batch') then ?df_admin_vtd_application_cron_message_apps_log

$template df_admin_vtd_application_cron_errors_apps_log,"/opt/data/log/syslog/technical-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/cron_errors.log"
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'Provisioning batch' or $msg contains 'Sync IPS batch') then ?df_admin_vtd_application_cron_errors_apps_log


if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so')  and ($syslogtag contains 'authentication_service_Apache-[ERROR]' or $syslogtag contains 'certificate_management_Apache-[ERROR]' or $syslogtag contains 'VTDS_Apache-[ERROR]') and not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' ) then ?df_admin_vtd_application_errors_apps_log

if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so')  and ($syslogtag contains 'certificate_management_Apache' or $syslogtag contains 'certificate_management_Apache_Rewrite' or $syslogtag contains 'authentication_service_Apache' or $syslogtag contains 'authentication_service_Apache_Rewrite' or $syslogtag contains 'VTDS_Apache' or $syslogtag contains 'VTDS_Apache_Rewrite') and not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' or $msg contains 'Apache_Rewrite' or $msg contains 'ERROR' or $syslogtag contains 'ERROR') then ?df_admin_vtd_application_message_apps_log

## MySQL APPS VTD
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and $syslogfacility-text == 'user' and ($syslogseverity-text == 'warn' or $syslogseverity-text == 'error') and ($msg contains 'VTDS' or $msg contains 'lost_password' or $msg contains 'certificate_management' or $msg contains 'authentication_service' or $msg contains 'OpenSSO' or $msg contains 'Provisioning batch' or $msg contains 'IPS SYNC') and  not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' or $msg contains 'bytes of entropy') then :ommysql:172.26.3.68,logs_web-apps-VTD,rsyslog,XfNkHeb3
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debug' or $syslogseverity-text == 'info' or $syslogseverity-text == 'notice') and ($msg contains 'VTDS' or $msg contains 'lost_password' or $msg contains 'certificate_management' or $msg contains 'authentication_service' or $msg contains 'OpenSSO' or $msg contains 'Provisioning batch' or $msg contains 'IPS SYNC')  and not ($msg contains 'bytes of entropy' or $msg contains 'ERROR' or $syslogtag contains 'ERROR') then :ommysql:172.26.3.68,logs_web-apps-VTD,rsyslog,XfNkHeb3
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so')  and ($syslogtag contains 'authentication_service_Apache-[ERROR]' or $syslogtag contains 'certificate_management_Apache-[ERROR]' or $syslogtag contains 'VTDS_Apache-[ERROR]') and not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' ) then :ommysql:172.26.3.68,logs_web-apps-VTD,rsyslog,XfNkHeb3
if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so')  and ($syslogtag contains 'certificate_management_Apache' or $syslogtag contains 'certificate_management_Apache_Rewrite' or $syslogtag contains 'authentication_service_Apache' or $syslogtag contains 'authentication_service_Apache_Rewrite' or $syslogtag contains 'VTDS_Apache' or $syslogtag contains 'VTDS_Apache_Rewrite') and not ($msg contains '172.25.3.156' or $msg contains '172.25.3.157' or $msg contains 'Apache_Rewrite' or $msg contains 'ERROR' or $syslogtag contains 'ERROR') then :ommysql:172.26.3.68,logs_web-apps-VTD,rsyslog,XfNkHeb3



# Filter for VTD Application to backup

$template df_admin_vtd_application_message_apps_for_backup_log,"/opt/data/log/backup/technical-directory/APPS/%$YEAR%/%$MONTH%/%$DAY%/messages.log"

if ($HOSTNAME == 'web1-so' or $HOSTNAME == 'web2-so') and $syslogfacility-text == 'user' and ($syslogseverity-text == 'debuog;RSYSLOG_TraditionalFileFormat


# Log cron stuff
cron.*							-/var/log/cron;RSYSLOG_TraditionalFileFormat

# Everybody gets emergency messages
*.emerg							*;RSYSLOG_TraditionalFileFormat

# Save news errors of level crit and higher in a special file.
uucp,news.crit						-/var/log/spooler;RSYSLOG_TraditionalFileFormat

# Save boot messages also to boot.log
local7.*						/var/log/boot.log;RSYSLOG_TraditionalFileFormat

# Remote Logging (we use TCP for reliable delivery)
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /rsyslog/spool # where to place spool files
#$ActionQueueFileName uniqName # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514

local2.=notice						/var/log/httpd/httpd_access.log;RSYSLOG_TraditionalFileFormat
local2.=warn						/var/log/httpd/httpd_error.log;RSYSLOG_TraditionalFileFormat
local2.=error						/var/log/httpd/error.log;RSYSLOG_TraditionalFileFormat
