### /etc/rsyslog.conf # enable network sources module(load="imudp") input(type="imudp" port="514") module(load="imtcp" MaxSessions="1000" MaxListeners="50") input(type="imtcp" port="514" # and handle inbound/slavepoller NMIS syslogs local7.* /usr/local/nmis8/logs/cisco.log local1.* /usr/local/nmis8/logs/slavepoller_event.log
Next we'll tell rsyslog where to file messages that arrive with the facility local6. (rsyslog can route messages based on many different attributes and has several other configuration options such as inserting a local timestamp. There is also the ability to place custom rsyslog configuration in any file with a .conf extension within the /etc/rsyslog.d/ directory. More information regarding rsyslog may be found here: http://www.rsyslog.com/doc/master/index.html)
### /etc/rsyslog.conf # and handle inbound/slavepoller NMIS syslogs local7.* /usr/local/nmis8/logs/cisco.log local6.* /usr/local/nmis8/logs/newVendor.log local1.* /usr/local/nmis8/logs/slavepoller_event.log
After modifying /etc/rsyslog.conf the syslog daemon must be restarted.