News.none mail.none -/home/user/rsyslog/log/debug *.* auth,authpriv.none -/home/user/rsyslog/log/syslogĭaemon.* -/home/user/rsyslog/log/daemon.log Log by facility.Īuth,authpriv.* /home/user/rsyslog/log/auth.log # For more information see nf(5) and /etc/nf # Include all config files in /etc/rsyslog.d/ # Set the default permissions for all log files. $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # To enable high precision timestamps, comment out the following line. # NOTE - listen on unprivileged port 2514 $ModLoad immark # provides -MARK- message capability nf is below - I would further tweak it for per-host logging, but that's beyond the scope: # Noteworthy is that nf seems to use absolute paths. Additionally the logging/spooling directories must be accessible. Access to the console, broadcast messages - eg xconsole etc.Īpart from that the networking modules work fine as long as they use non-priveleged ports.$FileOwner - ie chmod - obviously needs root.imklog - kernel logging - obviously needs root.imuxsock - local syslog logging (can't open /dev/log) - you could work around this with permissiosn - I didn't need it.If such capabilities are required usually rsyslog will complain inside its own logs. Assuming others have a similar use-case here is what I found:Ī number of typical rsyslog feature require root, but not all. I found this question while trying to run rsyslog as an unprivileged user to receive remote syslog data from a development-machine.

Arrsync run as root