rsyslog.conf

#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging

# provide UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provide TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
#
# $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Custom timestamp format with year
# To switch back to traditional timestamp format, comment out the following two lines
# and uncomment the above RSYSLOG_TraditionalFileFormat line.
# To enable high precision timestamps, comment out the following two lines.
#
$template CustomTemplate, "%timereported:1:3:% %timereported:::date-day% %timereported:::date-year% %timereported:::date-hour%:%timereported:::date-minute%:%timereported:::date-second% %HOSTNAME% %msg%\n"
$ActionFileDefaultTemplate CustomTemplate

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup root
$FileCreateMode 0644
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser root
$PrivDropToGroup root

#
# Where to place spool and state files
#
$WorkDirectory /var/spool

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


$template TmplMsg, "/var/log/%HOSTNAME%/all.log"
$template TmplErrMsg, "/var/log/%HOSTNAME%/errors.log"

local0.*   ?TmplMsg
local0.3   ?TmplErrMsg