module(load="imudp")
module(load="imtcp")

$template remoteAudit,    "/var/log/remote/%fromhost-ip%/audit.log"
$template remoteBoot,     "/var/log/remote/%fromhost-ip%/boot.log"
$template remoteCron,     "/var/log/remote/%fromhost-ip%/cron"
$template remoteMail,     "/var/log/remote/%fromhost-ip%/maillog"
$template remoteMessages, "/var/log/remote/%fromhost-ip%/messages"
$template remoteSecure,   "/var/log/remote/%fromhost-ip%/secure"
$template remoteSpooler,  "/var/log/remote/%fromhost-ip%/spooler"

$template auditFormat, "%msg%\n"

ruleset(name="remote") {
  if $pri-text == 'local6.info' and $programname == 'auditd-sender' then {
    local6.info   action(type="omfile" dynaFile="remoteAudit" template="auditFormat")
  } else {
    local7.*                                  action(type="omfile" dynaFile="remoteBoot")
    cron.*                                    action(type="omfile" dynaFile="remoteCron")
    mail.*                                    action(type="omfile" dynaFile="remoteMail" sync="off")
    *.info;mail.none;authpriv.none;cron.none  action(type="omfile" dynaFile="remoteMessages")
    authpriv.*                                action(type="omfile" dynaFile="remoteSecure")
    uucp,news.crit                            action(type="omfile" dynaFile="remoteSpooler")
  }
}

input(type="imudp" port="514" ruleset="remote")
input(type="imtcp" port="514" ruleset="remote")