Сбор сведений о среде

scp root@192.168.40.29:/etc/pki/ovirt-engine/rsyslog/rslserver-102.168.48.56.tar.gz /etc/pki/rsyslog
cd /etc/pki/rsyslog
tar xf rslserver-102.168.48.56.tar.gz

openssl x509 -text -noout -in rslserver-102.168.48.56-cert.pem

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

module(load="imuxsock"    # provides support for local system logging (e.g. via logger command)
    SysSock.Use="off") # Turn off message reception via local log socket;
            # local messages are retrieved through imjournal now.
module(load="imjournal"         # provides access to the systemd journal
    StateFile="imjournal.state") # File to store the position in the journal
#module(load="imklog") # reads kernel messages (the same are read from journald)
#module(load"immark") # provides --MARK-- message capability

# Increase the amount of open files rsyslog is allowed, which includes open tcp sockets
# This is important if there are many clients.
# http://www.rsyslog.com/doc/rsconf1_maxopenfiles.html
$MaxOpenFiles 2048

# make gtls driver the default
$DefaultNetstreamDriver gtls

$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/rsyslog-ca.pem
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/rslserver-192.168.48.56-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/rslserver-192.168.48.56-key.pem

# Provides UDP syslog reception
# for parameters see http://www.rsyslog.com/doc/imudp.html
module(load="imudp") # needs to be done just once
input(type="imudp" port="514" ruleset="RemoteLogProcess")

# Provides TCP syslog reception
# for parameters see http://www.rsyslog.com/doc/imtcp.html
module(load="imtcp"
    MaxSessions="2000"
    StreamDriver.mode="1"
    StreamDriver.authmode="x509/name"
    PermittedPeer="192.168.40.29" # list ip/fqdn
    ) # needs to be done just once
input(type="imtcp" port="514" ruleset="RemoteLogProcess")

# Шаблон для сохранения логов (/var/log/_ip_/_year-month-day_/_programname_with_catalog_)
template(name="RemoteLogSavePath" type="list") {
    constant(value="/var/log/")
    property(name="fromhost-ip")
    constant(value="/")
    property(name="timegenerated" dateformat="year")
    constant(value="-")
    property(name="timegenerated" dateformat="month")
    constant(value="-")
    property(name="timegenerated" dateformat="day")
    constant(value="/")
    property(name="$.logpath")
}

# Шаблон для вывода только сообщения
template(name="OnlyMsg" type="string" string="%msg:::drop-last-lf%\n")

# Загружаем модуль записи в файл
module(load="builtin:omfile"
    FileOwner="root"
    FileGroup="adm"
    dirOwner="root"
    dirgroup="adm"
    FileCreateMode="0640" DirCreateMode="0755")

# Интерпретировать \n как перевод строки
$EscapeControlCharactersOnReceive off

# Правило для разбора приходящих логов
ruleset(name="RemoteLogProcess") {
    if ( $syslogfacility >= 16 ) then
    {
        # Заменяем __ на /
        set $.logpath = replace($programname, "__", "/");
        # Сохранение в файл:
        # dynaFileCacheSize - максимальное количество открытых сгенерированных лог-файлов
        # dynaFile - правило для генерации имени лог-файла
        # template - шаблон записываемых сообщений
        # flushOnTXEnd - сброс буфера после приема сообщения
        # asyncWriting - асинхронная запись
        # flushInterval - время сброса буфера в секундах
        # ioBufferSize - размер буфера
        action(type="omfile" dynaFileCacheSize="1024" dynaFile="RemoteLogSavePath" template="OnlyMsg"
        flushOnTXEnd="off" asyncWriting="on" flushInterval="1" ioBufferSize="64k")
    } else {
        if (($syslogfacility == 0)) then {
            set $.logpath = "kern";
        }
        else if (($syslogfacility == 4) or ($syslogfacility == 10)) then {
            set $.logpath = "auth";
        }
        else if (($syslogfacility == 9) or ($syslogfacility == 15)) then {
            set $.logpath = "cron";
        } else {
            set $.logpath = "syslog";
        }
        action(type="omfile" dynaFileCacheSize="1024" dynaFile="RemoteLogSavePath" template="RSYSLOG_FileFormat"
        flushOnTXEnd="off" asyncWriting="on" flushInterval="1" ioBufferSize="64k")
    }
}

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
global(workDirectory="/var/lib/rsyslog")

# Use default timestamp format
#module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

# Include all config files in /etc/rsyslog.d/
include(file="/etc/rsyslog.d/*.conf" mode="optional")

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

global(debug.gnutls="10" debug.logFile="/var/log/rsyslogdebug.log")