rsyslog quick reference

Core idea

rsyslog receives messages and routes them according to rules. Facilities describe sources; severities describe priority. The systemd journal is a separate logging store.

Configuration

/etc/rsyslog.conf
/etc/rsyslog.d/*.conf

Example selector

authpriv.*    /var/log/auth-custom.log

Validate configuration

sudo rsyslogd -N1

Generate test messages

logger -p user.notice "context-switch test message"
logger -p authpriv.info "authentication test"

Troubleshoot

journalctl -u rsyslog --since today
systemctl status rsyslog

Notes

File paths and facility routing differ by distribution. Beware duplicate ingestion between journald and rsyslog, and confirm permissions and logrotate policy for custom files.