### Autogenerated by system_syslog.py ###

#### MODULES ####
# Load input modules for local logging and journald

# Old-style log file format with low-precision timestamps
# A modern-style logfile format with high-precision timestamps and timezone info
# RSYSLOG_FileFormat
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
module(load="imuxsock")  # provides support for local system logging (collection from /dev/log unix socket)

# Import logs from journald, which includes kernel log messages
module(
    load="imjournal"
    StateFile="/var/spool/rsyslog/imjournal.state"  # Persistent state file to track the journal cursor
    Ratelimit.Interval="0"  # Disable rate limiting (set to "0" for no limit)
    RateLimit.Burst="0"
)

###########################
#### GLOBAL DIRECTIVES ####
###########################
# Log specific programs to auth.log, then stop further processing
if (
    $programname == "CRON" or
    $programname == "sudo" or
    $programname == "su"
) then {
    action(type="omfile" file="/var/log/auth.log")
    stop
}

global(workDirectory="/var/spool/rsyslog")

###############
#### RULES ####
###############

# Send emergency messages to all logged-in users
*.emerg action(type="omusrmsg" users="*")

{% if marker is vyos_defined and marker.disable is not vyos_defined %}
# Load the immark module for periodic --MARK-- message capability
module(load="immark" interval="{{ marker.interval }}")
{% endif %}
{% if preserve_fqdn is vyos_defined %}
# Preserve the fully qualified domain name (FQDN) in log messages
global(preserveFQDN="on")
{%     if preserve_fqdn.host_name is vyos_defined and preserve_fqdn.domain_name is vyos_defined %}
# Set the local hostname for log messages
global(localHostname="{{ preserve_fqdn.host_name }}.{{ preserve_fqdn.domain_name }}")
{%     endif %}
{% endif %}

{# Build a prifilt selector list with "all" excluding any explicitly-set facilities #}
{% macro prifilt_selectors(facility_map) %}
{# pass 1: collect explicit facilities #}
{% set selectors = [] %}
{% set keys = facility_map.keys() | list | sort %}
{% set specific = [] %}
{% for facility in keys %}
{%     if facility != 'all' %}
{%         set _ = specific.append(facility) %}
{%     endif %}
{% endfor %}
{# pass 2: build selectors; add ;fac.none exclusions to wildcard #}
{% for facility in keys %}
{%     set opts = facility_map[facility] %}
{%     set level = opts.level.replace('all', 'debug') %}
{%     if facility == 'all' %}
{%         set ns = namespace(sel="*." ~ level) %}
{%         for sf in specific %}
{%             set ns.sel = ns.sel ~ ";" ~ sf ~ ".none" %}
{%         endfor %}
{%         set sel = ns.sel %}
{%     else %}
{%         set sel = facility ~ "." ~ level %}
{%     endif %}
{%     set _ = selectors.append(sel) %}
{% endfor %}
{{ selectors | join(',') }}
{% endmacro %}

#### GLOBAL LOGGING ####
{% if local.facility is vyos_defined %}
if prifilt("{{ prifilt_selectors(local.facility) | trim }}") then {
    action(
        type="omfile"
        file="/var/log/messages"
        rotation.sizeLimit="{{ logrotate_size_limit }}" # maximum filesize before rotation
        rotation.sizeLimitCommand="/usr/sbin/logrotate {{ logrotate }}"
    )
}
{% endif %}

#### CONSOLE LOGGING ####
{% if console.facility is vyos_defined %}
if prifilt("{{ prifilt_selectors(console.facility) | trim }}") then {
    action(type="omfile" file="/dev/console")
}
{% endif %}

#### REMOTE LOGGING ####
{% if remote is vyos_defined %}
{%     for remote_name, remote_options in remote.items() %}
{%         if remote_options.facility is vyos_defined %}
{%             set tls = remote_options.tls %}
# Remote syslog to {{ remote_name }}
if prifilt("{{ prifilt_selectors(remote_options.facility) | trim }}") then {
    action(
        type="omfwd"
        # Remote syslog server where we send our logs to
        target="{{ remote_name }}"
        # Port on the remote syslog server
        port="{{ remote_options.port }}"
        protocol="{{ 'tcp' if tls is vyos_defined else remote_options.protocol }}"
{%             if remote_options.format.include_timezone is vyos_defined %}
        template="RSYSLOG_SyslogProtocol23Format"
{%             endif %}
        TCP_Framing="{{ 'octet-counted' if remote_options.format.octet_counted is vyos_defined else 'traditional' }}"
{%             if remote_options.source_address is vyos_defined %}
        Address="{{ remote_options.source_address }}"
{%             endif %}
{%             if remote_options.vrf is vyos_defined %}
        Device="{{ remote_options.vrf }}"
{%             endif %}
{%             if tls is vyos_defined %}
{%                 set auth_mode = tls.auth_mode %}
        # Specify the use of the OpenSSL TLS driver for this action
        StreamDriver="ossl"
        # Set mode to TLS-only connections (do not accept plain TCP)
        StreamDriverMode="1"
        # Select the authentication mode
        StreamDriverAuthMode="{{ auth_mode if auth_mode == 'anon' else 'x509/' + auth_mode }}"
{%                 if tls.permitted_peer is vyos_defined and auth_mode in ('fingerprint', 'name') %}
{%                     set permitted_peers = tls.permitted_peer | map('trim') | select | join(',') %}
{%                     if permitted_peers %}
        # Only include permitted peers (list of allowed fingerprints or names)
        StreamDriverPermittedPeers="{{ permitted_peers }}"
{%                     endif %}
{%                 endif %}
{%                 if tls.ca_certificate_path is vyos_defined %}
        # Include the path to the CA certificate file
        StreamDriver.CAFile="{{ tls.ca_certificate_path }}"
{%                 endif %}
{%                 if tls.certificate_path is vyos_defined %}
        # Include the path to the client's certificate
        StreamDriver.CertFile="{{ tls.certificate_path }}"
{%                 endif %}
{%                 if tls.certificate_key_path is vyos_defined %}
        # Include the path to the client's private key
        StreamDriver.KeyFile="{{ tls.certificate_key_path }}"
{%                 endif %}
{%             endif %}
    )
}
{%         endif %}
{%     endfor %}
{% endif %}

# Include all configuration files in /etc/rsyslog.d/
include(file="/etc/rsyslog.d/*.conf")