# /etc/rsyslog.d/99-portal.conf
# 將 syslog / auth / Apache / dmesg 轉送到 portal.steps.tw:5140
#
# 安裝後執行：sudo systemctl restart rsyslog

# ── 載入 imfile 模組（讀取任意檔案） ──────────────────────────────────────────
module(load="imfile")

# ── Apache access log ─────────────────────────────────────────────────────────
input(type="imfile"
      File="/var/log/apache2/access.log"
      Tag="apache-access"
      Severity="info"
      Facility="local6"
      PersistStateInterval="200"
      freshStartTail="on")

# ── Apache error log ──────────────────────────────────────────────────────────
input(type="imfile"
      File="/var/log/apache2/error.log"
      Tag="apache-error"
      Severity="error"
      Facility="local6"
      PersistStateInterval="200"
      freshStartTail="on")

# ── Nginx（如有安裝，取消以下 # 字號） ──────────────────────────────────────────
#input(type="imfile"
#      File="/var/log/nginx/access.log"
#      Tag="nginx-access"
#      Severity="info"
#      Facility="local7"
#      freshStartTail="on")
#input(type="imfile"
#      File="/var/log/nginx/error.log"
#      Tag="nginx-error"
#      Severity="error"
#      Facility="local7"
#      freshStartTail="on")

# ── 轉送規則 ─────────────────────────────────────────────────────────────────
# syslog + auth + kernel(dmesg)
*.* action(type="omfwd"
           target="portal.steps.tw"
           port="5140"
           protocol="tcp"
           action.resumeRetryCount="-1"
           queue.type="linkedList"
           queue.size="10000"
           queue.saveOnShutdown="on")

# Apache（local6）
local6.* action(type="omfwd"
                target="portal.steps.tw"
                port="5140"
                protocol="tcp"
                action.resumeRetryCount="-1"
                queue.type="linkedList"
                queue.size="5000")

# Nginx（local7，取消 # 號啟用）
#local7.* action(type="omfwd"
#                target="portal.steps.tw"
#                port="5140"
#                protocol="tcp"
#                action.resumeRetryCount="-1"
#                queue.type="linkedList"
#                queue.size="5000")
