Use this documentation with care! It describes the outdated version 7, which was actively developed around 2014 and is considered dead by the rsyslog team.

This documentation reflects the latest update of the v7-stable branch. It describes the 7.6.8 version, which was never released. As such, it contains some content that does not apply to any released version.

To obtain the doc that properly matches your installed v7 version, obtain the doc set from your distro. Each version of rsyslog contained the version that exactly matches it.

As general advise, it is strongly suggested to upgrade to the current version supported by the rsyslog project. The current version can always be found on the right-hand side info box on the rsyslog web site.

Note that there is only limited rsyslog community support available for the outdated v7 version (officially we do not support it at all, but we usually are able to answer simple questions). If you need to stick with v7, it probably is best to ask your distribution for support.

global() configuration object

The global configuration object permits to set global parameters. Note that each parameter can only be set once and cannot be re-set thereafter. If a parameter is set multiple times, the behaviour is unpredictable.

The following paramters can be set:

  • action.reportSuspension - binary, default “on”, v7.5.8+

    If enabled (“on”) action will log message under syslog.* when an action suspends or resume itself. This usually happens when there are problems connecting to backend systems. If disabled (“off”), these messages are not generated. These messages can be useful in detecting problems with backend systems. Most importantly, frequent suspension and resumption points to a problem area.

  • action.reportSuspensionContinuation - binary, default “off”, v7.6.1+, v8.2.0+

    If enabled (“on”) the action will not only report the first suspension but each time the suspension is prolonged. Otherwise, the follow-up messages are not logged. If this setting is set to “on”, action.reportSuspension is also automaticaly turned “on”.

  • workDirectory

  • dropMsgsWithMaliciousDNSPtrRecords

  • localHostname

  • preserveFQDN

  • defaultNetstreamDriverCAFile

    For TLS syslog, the CA certificate that can verify the machine keys and certs (see below)

  • defaultNetstreamDriverKeyFile

    Machine private key

  • defaultNetstreamDriver

    Set it to “gtls” to enable TLS for TLS syslog

  • maxMessageSize

    The maximum message size rsyslog can process. Default is 4K. Anything above the maximum size will be truncated.

  • debug.onShutdown available in 7.5.8+

    If enabled (“on”), rsyslog will log debug messages when a system shutdown is requested. This can be used to track issues that happen only during shutdown. During normal operations, system performance is NOT affected. Note that for this option to be useful, the debug.logFile parameter must also be set (or the respective environment variable).

  • debug.logFile available in 7.5.8+

    This is used to specify the debug log file name. It is used for all debug output. Please note that the RSYSLOG_DEBUGLOG environment variable always overrides the value of debug.logFile.

[rsyslog.conf overview] [RainerScript reference] [rsyslog site]

This documentation is part of the rsyslog project. Copyright © 2013-2014 by Rainer Gerhards and Adiscon. Released under ASL 2.0 or higher.

Previous topic

The rsyslog “call” statement

Next topic


This Page