#=============================================================
#### MODULES ####
#=============================================================
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal

## Syslog Serfer
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

#=============================================================
#### GLOBAL DIRECTIVES ####
#=============================================================
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state

# Syslog Server
$umask 0022
$FileCreateMode 0644
$DirCreateMode 0755

#=============================================================
#### RULES ####
# Rules are applied sequentially from the top
#=============================================================
# Syslog Server Rule
$template RemoteHost, "/var/log/rsyslog/%$year%/%$month%/%$day%/%hostname%.%$year%%$month%%$day%.log"
:fromhost-ip, !isequal, "127.0.0.1" -?RemoteHost
& ~

# Default Rule
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log

# Template name is RemoteHost
$template RemoteHost, "/var/log/rsyslog/%hostname%/%hostname%.%$year%%$month%%$day%.log"
:fromhost-ip, !isequal, "127.0.0.1" -?RemoteHost
& ~

# Template name is RemoteHost
$template RemoteHost, "/var/log/rsyslog/%hostname%/%$year%/%$month%/%hostname%.%$day%.log"
:fromhost-ip, !isequal, "127.0.0.1" -?RemoteHost
& ~

# Template name is RemoteHost
$template RemoteHost, "/var/log/rsyslog/%$year%/%$month%/%$day%/%fromhost%_%$year%%$month%%$day%.log"
:fromhost-ip, !isequal, "127.0.0.1" -?RemoteHost
& ~

$ModLoad imudp
$UDPServerRun 514
$AllowedSender UDP, 127.0.0.1, *.example.com, 192.168.0.0/24, 10.50.0.0/16

$ModLoad imtcp
$InputTCPServerRun 514
$AllowedSender TCP, 127.0.0.1, *.example.com, 192.168.0.0/24, 10.50.0.0/16

rsyslog (rsyslog.py)