# docs: `man rsyslog.conf`
# docs: <https://www.rsyslog.com/doc/index.html>

### INPUTS/SOURCES
# imjournal: pull from systemd-journald.
# - use a StateFile, so that we can read the whole journal the first time we start,
#   and then survive restarts by picking up where we left off
# - example: <https://www.rsyslog.com/doc/configuration/modules/imjournal.html#example-1>
# XXX: the recommended alternative is to have journald forward events to /run/systemd/journal/syslog
#   and rsyslogd slurps that. unfortunately, that results in many lost messages --
#   and especially if the gap between launching journald and unlocking the private store is lengthy.
#
module(load="imjournal" StateFile="$HOME/.local/share/rsyslog/journal.state")

### OUTPUTS
# selector format is `<facility>.<priority>`
# valid facilities are:
# - auth
# - authpriv
# - cron
# - daemon
# - kern
# - lpr
# - mail
# - mark
# - news
# - syslog
# - user
# - uucp
# - local0 through local7
# valid priorities are:
# - debug
# - info
# - notice
# - warning
# - err
# - crit
# - alert
# - emerg
# *.info matches priority `info` or greater
# *.=info matches only priotity `info`
# *.!info matches priority `info` or *lower*
#
# each rule matches in parallel; logs can be sent multiple places

# send warning/higher to a special place
*.warning                     $HOME/.local/share/rsyslog/logs/warn
*.*                           $HOME/.local/share/rsyslog/logs/all
