rsyslog.conf

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

:msg, contains, "iptables: " -/var/log/iptables.log
& ~

auth,authpriv.*                 /var/log/auth.log
& ~

*.* @@logs.loggly.com:36588

mail.*                          -/var/log/mail.log
& ~

cron.*                          /var/log/cron.log
& ~

daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log

*.*                             -/var/log/everything.log

*.emerg                         :omusrmsg:*
*.err;*.emerg                   -/var/log/errors.log