# Module Loading
# Version 1.46 - updated impstats to 10 min interval, previously 10 seconds

## Input Modules
# Local Logging (systemd)
module(load="imklog" 
       permitnonkernelfacility="on"
      )

module(load="imuxsock"    # Provides support for local system logging (e.g. via logger command)
       syssock.use="off"  # Turn off message reception via local log socket.
       ) 

module(load="imjournal"
       statefile="/var/lib/rsyslog/imjournal.state"
       ratelimit.burst="20000"
       ratelimit.interval="600"
       persiststateinterval="10"
       )

# Rsyslog Performance Statistics (pstats)
module(load="impstats"
       severity="7"
       interval="600" 
       resetcounters="on"  # Send deltas
       )

# Remote Logging (tcp)
module(load="imptcp"
       threads="1"
      )

# Remote Logging (udp)
module(load="imudp"
       threads="2"
       timerequery="8"
       batchsize="128"
      )

## Output Modules
# Local Logging (syslog)
module(load="builtin:omfile" 
       template="TraditionalFwdWithIP"
      )
# Enable OMUDPSPOOF which will manipulate the UDP header to contain the log source IP.  
# Note that Azure blocks UDP spoofing so we do not use this module for forwarding to Qradar and Kiwi.
# We still use it for Sentinel since the spoofed packets never leave the syslog forwarder.  The packets are encapsulated by OMSAGENT.
module (load="omudpspoof")
