Configuration Formats#

rsyslog supports four configuration formats. For new configs use RainerScript (advanced); YAML is a good alternative if you are more comfortable with YAML syntax.

Rsyslog has evolved over several decades. For this reason, it supports four different configuration formats:

basic - previously known as the sysklogd format. Best for simple, one-line configurations matching on facility/severity and writing to a log file.
advanced - previously known as the RainerScript format. The recommended format for all non-trivial use cases. First available in rsyslog v6, it handles advanced filtering, forwarding, queueing, and custom actions.
yaml - an alternative syntax for users more comfortable with YAML than with RainerScript. Every YAML key maps directly to the equivalent RainerScript parameter, so both formats share the same feature set. See YAML Configuration Format for full reference.
obsolete legacy - previously known as the legacy format. This format is obsolete and must not be used in new configurations.

Which Format Should I Use?#

For New Configurations#

Use the advanced format for all new configurations due to its flexibility, precision, and control. It handles complex use cases such as advanced filtering, forwarding, and actions with specific parameters.

If You Prefer YAML#

If you are already familiar with YAML and find it more readable than RainerScript, use the YAML format. The two formats are functionally equivalent — you can also mix them: a YAML main config may include RainerScript .conf fragments and vice versa.

Existing Configurations in Basic Format#

Some distributions ship default configurations in basic format. Converting them to advanced is straightforward and recommended if you plan to add complex constructs such as rulesets or queued actions.

Retaining Basic Format#

Continue using the basic format if there is a strong reliance on external documentation or many existing configurations in that format.

Example - Basic Format#

mail.info /var/log/mail.log
mail.err @@server.example.net

Advanced Use Cases#

For anything beyond basic logging, use the advanced format:

Fine control via advanced parameters
Easy-to-follow block structure
Safe for use with include files

Example - Advanced Format#

mail.err action(type="omfwd" protocol="tcp" queue.type="linkedList")

Deprecated Format#

Do not use obsolete legacy format. It is obsolete and will make your life difficult. It exists solely for backward compatibility with very old configurations.

Conclusion#

Use advanced for new configurations, or the YAML format if you prefer YAML syntax. The basic format is acceptable for simple, existing configurations. Never use obsolete legacy.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project