syslog集約サーバのrsyslog.conf。とりあえず版

rsyslog.conf

$ModLoad imuxsock
$ModLoad imklog
$ModLoad imudp

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template RemoteLog, "/var/log/remote/%hostname:::secpath-replace%/%hostname:::secpath-replace%_%$year%%$month%%$day%.log"

$RuleSet local
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log

$RuleSet remote
*.* ?RemoteLog

$DefaultRuleset local

$AllowedSender UDP, 127.0.0.0/8, 192.168.1.0/24
$InputUDPServerBindRuleset remote
$UDPServerRun 514

#$IncludeConfig /etc/rsyslog.d/*.conf