####################### ### DEFAULT ACTIONS ### ####################### auth,authpriv.* action( name="action_auth" type="omfile" File="/var/log/auth.log" FileCreateMode="0600" FileOwner="root" FileGroup="adm" Sync="off" ) cron.* action( name="action_cron" type="omfile" File="/var/log/cron.log" FileOwner="root" FileGroup="adm" ) daemon.* action( name="action_daemon" type="omfile" File="/var/log/daemon.log" FileOwner="root" FileGroup="adm" ) kern.* action( name="action_kern" type="omfile" File="/var/log/kern.log" FileOwner="root" FileGroup="adm" ) lpr.* action( name="action_lpr" type="omfile" File="/var/log/lpr.log" FileOwner="root" FileGroup="adm" ) mail.* action( name="action_mail" type="omfile" File="/var/log/mail.log" FileOwner="root" FileGroup="adm" ) news.* action( name="action_news" type="omfile" File="/var/log/news.log" FileOwner="root" FileGroup="adm" ) user.* action( name="action_user" type="omfile" File="/var/log/user.log" FileOwner="root" FileGroup="adm" ) *.=debug;auth,authpriv,news,mail.none action( name="action_debug" type="omfile" File="/var/log/debug.log" FileOwner="root" FileGroup="adm" ) *.info;auth,authpriv,cron,daemon,lpr,mail,news.none action( name="action_messages" type="omfile" File="/var/log/messages" FileOwner="root" FileGroup="adm" ) # Uncomment the following directive to re-enable the # deprecated "/var/log/syslog" log file (don't forget to re-enable log # rotation in "/etc/logrotate.d/rsyslog" if you do that!) #*.*;auth,authpriv.none action( # name="action_syslog" # type="omfile" # File="/var/log/syslog" # FileOwner="root" # FileGroup="adm" #) *.emerg action( name="action_emerge" type="omusrmsg" Users="*" action.execOnlyOnceEveryInterval="10" ) # Create an additional socket for the default chroot location # (used by net-misc/openssh[hpn], see https://bugs.gentoo.org/490744) input(type="imuxsock" Socket="/var/empty/dev/log")