$PreserveFQDN on
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ModLoad imuxsock
$ModLoad imklog
$SystemLogRateLimitBurst 2000
$SystemLogRateLimitInterval 0


#$ModLoad imudp
#$ModLoad imtcp

# Place to store messages in case of a problem
$DefaultNetstreamDriver gtls
$WorkDirectory /var/log/buffer
#---
# start forwarding rule 1 for sensage
#---
$ActionQueueType LinkedList
$ActionQueueFileName sensage
$ActionResumeRetryCount 2
$ActionQueueSaveOnShutdown on
$RepeatedMsgReduction on
# ois is still on udp
#*.*     @esm08c.itso.census.gov
*.*     @172.24.99.146



#delete this from the rest of the rules
:msg,contains,"audispd" /var/log/audit/syslogaudit.log
:msg,contains,"audit(" /var/log/audit/syslogaudit.log
:msg,contains,"audispd" ~
:msg,contains,"audit(" ~

# Forwarding rule #2
$ActionQueueType LinkedList
$ActionQueueFileName csvd-syslog
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on


# certificate files
$DefaultNetstreamDriverCAFile /etc/rsyslog5/cacert.crt
#$DefaultNetstreamDriverCertFile /etc/rsyslog5/cert.pem
#$DefaultNetstreamDriverKeyFile /etc/rsyslog5/key.pem
$DefaultNetstreamDriverCertFile /etc/rsyslog5/HOST-syslog.crt
$DefaultNetstreamDriverKeyFile /etc/rsyslog5/HOST.pem

$ActionSendStreamDriverAuthMode x509/name
#$ActionSendStreamDriverPermittedPeer central.example.net
$ActionSendStreamDriverPermittedPeer os3.csvd.census.gov

$ActionSendStreamDriverMode 1 # run driver in TLS-only mode
# os3.csvd.census.gov
#*.* @@172.24.100.17:10514 # forward everything to remote server
*.* @@172.24.100.17:6514 # forward everything to remote server


:msg,contains,"IPTABLES " /var/log/iptables.log
:msg,contains,"IPTABLES " ~

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;auth.*;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
