Tuning rsyslog

Make sure the target folder exists, e.g.,

ls -al /data/logs/

Allow rsyslog to listen on port 514, disable rsyslog facilities local1,2,3 on ‘messages’ and enable it only for /data/logs/APPNAME/…,

cd /etc/
cp -pi rsyslog.conf rsyslog.conf.dist
vi rsyslog.conf

*.info;mail.none;authpriv.none;cron.none;local1.none;local2.none    /var/log/messages

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

local1.*        /data/logs/APPNAME/special1.log
local2.*        /data/logs/APPNAME/special2.log

service rsyslog restart