Rsyslog 7.2+ introduced a couple of cool config enhancements, among them a new way to specify rulesets and to call into a ruleset (a much better replacement for omruleset). Unfortunatley, the doc is currently extremely sparse. That will change soon, but in the mean time I thought I provide at least some clues here via the blog.
In essence, the ruleset statement permits to specify a ruleset. It’s written as
ruleset(name="rulesetname") { statements here }
Rulesets can be bound to inputs, as usual, and any ruleset can call into another ruleset via the call statement:
call rulesetname
A somewhat larger sample (bascially taken from the rsyslog mailing list, thanks to Brian Knox) is:
module(load="imptcp" keepalive="on")# use imptcp just as example for bind ruleset below
ruleset(name="rs1") { *.* /var/log/test1.log
}
ruleset(name="rs2") {
*.* /var/log/test2.log
call rs1
}
input(type="imptcp" port="13514" ruleset="rs2")
All statements NOT specified inside a ruleset become part of the default ruleset. Legacy-style $Ruleset statements are still supported, but cannot be used inside a ruleset() statement (that would create a big mess and is totally unnecessary).