diff --git a/CHANGELOG.rst b/CHANGELOG.rst
new file mode 100644
index 0000000..1fe88f9
--- /dev/null
+++ b/CHANGELOG.rst
@@ -0,0 +1,6 @@
+rsyslog formula
+=========================================
+
+0.0.1 (2015-12-4)
+
+- Initial formula setup
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..6f2b42f
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,13 @@
+Copyright (c) 2014-2015 tcp cloud a.s.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
\ No newline at end of file
diff --git a/README.rst b/README.rst
new file mode 100644
index 0000000..a0f5b5a
--- /dev/null
+++ b/README.rst
@@ -0,0 +1,27 @@
+
+==================================
+rsyslog
+==================================
+
+In computing, syslog is a widely used standard for message logging. It permits separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them.
+
+Sample pillars
+==============
+
+Single rsyslog service
+
+.. code-block:: yaml
+
+    rsyslog:
+      client:
+        enabled: true
+        format:
+          name: TraditionalFormatWithPRI
+          template: '"%pri-text%: %timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"'
+
+Read more
+=========
+
+http://www.rsyslog.com/
+https://wiki.gentoo.org/wiki/Rsyslog
+https://github.com/saz/puppet-rsyslog
diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..49d5957
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+0.1
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..00b7b06
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,6 @@
+
+salt-formula-heat (0.1) trusty; urgency=medium
+
+  * Initial release
+
+ -- Jan Kaufman <jan.kaufman@tcpcloud.eu>  Thu, 13 Aug 2015 23:23:41 +0200
diff --git a/debian/compat b/debian/compat
new file mode 100644
index 0000000..ec63514
--- /dev/null
+++ b/debian/compat
@@ -0,0 +1 @@
+9
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..973ac55
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,15 @@
+Source: salt-formula-rsyslog
+Maintainer: Jan Kaufman <jan.kaufman@tcpcloud.eu>
+Section: admin
+Priority: optional
+Build-Depends: debhelper (>= 9)
+Standards-Version: 3.9.6
+Homepage: http://www.tcpcloud.eu
+Vcs-Browser: https://github.com/tcpcloud/salt-formula-rsyslog
+Vcs-Git: https://github.com/tcpcloud/salt-formula-rsyslog.git
+
+Package: salt-formula-rsyslog
+Architecture: all
+Depends: ${misc:Depends}, salt-master, reclass
+Description: rsyslog salt formula
+ Install and configure rsyslog system.
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..90dd965
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,15 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: salt-formula-rsyslog
+Upstream-Contact: 
+Source: https://github.com/tcpcloud/salt-formula-rsyslog
+
+Files: *
+Copyright: 2014-2015 tcp cloud a.s.
+License: Apache-2.0
+  Copyright (C) 2014-2015 tcp cloud a.s.
+  .
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  .
+  On a Debian system you can find a copy of this license in
+  /usr/share/common-licenses/Apache-2.0.
diff --git a/debian/docs b/debian/docs
new file mode 100644
index 0000000..d585829
--- /dev/null
+++ b/debian/docs
@@ -0,0 +1,3 @@
+README.rst
+CHANGELOG.rst
+VERSION
diff --git a/debian/install b/debian/install
new file mode 100644
index 0000000..102ccf5
--- /dev/null
+++ b/debian/install
@@ -0,0 +1,4 @@
+_modules/*         /usr/share/salt-formulas/env/_modules/
+_states/*         /usr/share/salt-formulas/env/_states/
+rsyslog/*             /usr/share/salt-formulas/env/rsyslog/
+metadata/service/*      /usr/share/salt-formulas/reclass/service/rsyslog/
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..abde6ef
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,5 @@
+#!/usr/bin/make -f
+
+%:
+	dh $@
+
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000..89ae9db
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (native)
diff --git a/metadata/service/client/single.yml b/metadata/service/client/single.yml
new file mode 100644
index 0000000..c86acaf
--- /dev/null
+++ b/metadata/service/client/single.yml
@@ -0,0 +1,6 @@
+applications:
+- rsyslog
+parameters:
+  rsyslog:
+    client:
+      enabled: true
diff --git a/rsyslog/common.sls b/rsyslog/common.sls
new file mode 100644
index 0000000..1f47c7d
--- /dev/null
+++ b/rsyslog/common.sls
@@ -0,0 +1,23 @@
+{%- from "rsyslog/map.jinja" import common with context %}
+
+rsyslog_packages:
+  pkg.latest:
+  - names: {{ common.pkgs }}
+
+/etc/rsyslog/rsyslog.conf:
+  file.managed:
+  - source: salt://rsyslog/files/rsyslog.conf
+  - template: jinja
+  - mode: 640
+  - group: rsyslog
+  - require:
+    - pkg: rsyslog_packages
+
+rsyslog_service:
+  service.running:
+  - enable: true
+  - name: rsyslog
+  - watch:
+    - file: /etc/rsyslog/rsyslog.conf
+
+{%- endif %}
diff --git a/rsyslog/files/rsyslog.conf b/rsyslog/files/rsyslog.conf
new file mode 100644
index 0000000..5ab2aa8
--- /dev/null
+++ b/rsyslog/files/rsyslog.conf
@@ -0,0 +1,64 @@
+{%- from "rsyslog/map.jinja" import server with context -%}
+#  /etc/rsyslog.conf    Configuration file for rsyslog.
+#
+#                       For more information see
+#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
+#
+#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf
+
+
+#################
+#### MODULES ####
+#################
+
+$ModLoad imuxsock # provides support for local system logging
+$ModLoad imklog   # provides kernel logging support
+#$ModLoad immark  # provides --MARK-- message capability
+
+# provides UDP syslog reception
+#$ModLoad imudp
+#$UDPServerRun 514
+
+# provides TCP syslog reception
+#$ModLoad imtcp
+#$InputTCPServerRun 514
+
+# Enable non-kernel facility klog messages
+$KLogPermitNonKernelFacility on
+
+###########################
+#### GLOBAL DIRECTIVES ####
+###########################
+
+#
+# Use traditional timestamp format.
+# To enable high precision timestamps, comment out the following line.
+#
+$ActionFileDefaultTemplate {% if client.format is defined %}{{ client.format.name }},{{ client.format.value }}
+{% else %}
+ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
+{% endif %}
+
+# Filter duplicated messages
+$RepeatedMsgReduction on
+
+#
+# Set the default permissions for all log files.
+#
+$FileOwner syslog
+$FileGroup adm
+$FileCreateMode 0640
+$DirCreateMode 0755
+$Umask 0022
+$PrivDropToUser syslog
+$PrivDropToGroup syslog
+
+#
+# Where to place spool and state files
+#
+$WorkDirectory /var/spool/rsyslog
+
+#
+# Include all config files in /etc/rsyslog.d/
+#
+$IncludeConfig /etc/rsyslog.d/*.conf
diff --git a/rsyslog/files/sensu.conf b/rsyslog/files/sensu.conf
new file mode 100644
index 0000000..2d58191
--- /dev/null
+++ b/rsyslog/files/sensu.conf
@@ -0,0 +1,6 @@
+local_rsyslog_proc:
+  command: "PATH=$PATH:/usr/lib64/nagios/plugins:/usr/lib/nagios/plugins check_procs -C rsyslogd -u syslog -c 1:1"
+  interval: 60
+  occurrences: 1
+  subscribers:
+  - local-rsyslog-server
diff --git a/rsyslog/init.sls b/rsyslog/init.sls
new file mode 100644
index 0000000..286b9c3
--- /dev/null
+++ b/rsyslog/init.sls
@@ -0,0 +1,9 @@
+{%- if pillar.rsyslog is defined %}
+include:
+{%- if pillar.rsyslog.server is defined %}
+- rsyslog.server
+{%- endif %}
+{%- if pillar.rsyslog.client is defined %}
+- rsyslog.client
+{%- endif %}
+{%- endif %}
diff --git a/rsyslog/map.jinja b/rsyslog/map.jinja
new file mode 100644
index 0000000..d36a63f
--- /dev/null
+++ b/rsyslog/map.jinja
@@ -0,0 +1,14 @@
+{%- load_yaml as base_defaults %}
+Debian:
+  pkgs:
+  - rsyslog
+  service:
+  - rsyslogd
+RedHat:
+  pkgs:
+  - rsyslog
+  service:
+  - rsyslogd
+{%- endload %}
+{%- set server = salt['grains.filter_by'](base_defaults, merge=salt['pillar.get']('rsyslog:server')) %}
+{%- set client = salt['grains.filter_by'](base_defaults, merge=salt['pillar.get']('rsyslog:client')) %}