{%- load_yaml as base_defaults %}
Debian:
  pkgs:
  - rsyslog
  service:
  - rsyslogd
  enabled: true
  spool_dir: /var/spool/rsyslog
  omit_local_logging: false
  preserve_fqdn: false
  non_kernel_facility: true
  msg_reduction: true
  manage_file_perms: true
  perm_dir: "0755"
  run_user: syslog
  run_group: syslog
  rsyslog_d: /etc/rsyslog.d
  modules:
  - imuxsock
  - imklog
  format:
    name: Rfc3164Log
    template: '<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\n'
  output:
    file:
      /var/log/syslog:
        sync: false
        filter: "*.*;auth,authpriv.none"
        owner: syslog
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/auth.log:
        sync: true
        filter: "auth,authpriv.*"
        owner: syslog
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/kern.log:
        sync: false
        filter: "kern.*"
        owner: syslog
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/mail.log:
        sync: false
        filter: "mail.*"
        owner: syslog
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/mail.err:
        sync: false
        action: /var/log/mail.err
        filter: mail.err
        owner: syslog
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
    console:
      wall:
        action: ":omusrmsg:*"
        filter: "*.emerg"
        enabled: true
      xconsole:
        action: "|/dev/xconsole"
        filter: "daemon.*;mail.*;news.err;*.=debug;*.=info;*.=notice;*.=warn"
        enabled: false
    remote:
      somehost.domain:
        action: "@@remote-host:514"
        filter: "*.*"
        enabled: false
RedHat:
  pkgs:
  - rsyslog
  service:
  - rsyslogd
  enabled: true
  spool_dir: /var/lib/rsyslog
  omit_local_logging: true
  preserve_fqdn: false
  non_kernel_facility: false
  msg_reduction: false
  manage_file_perms: true
  perm_dir: "0755"
  run_user: root
  run_group: root
  rsyslog_d: /etc/rsyslog.d
  modules:
  - imjournal
  - imuxsock
  format:
    name: Rfc3164Log
    template: '<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\n'
  output:
    file:
      /var/log/messages:
        sync: true
        filter: "*.info;mail.none;authpriv.none;cron.none"
        owner: root
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/secure:
        sync: true
        filter: "authpriv.*"
        owner: root
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/maillog:
        sync: true
        filter: "mail.*"
        owner: root
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/cron:
        sync: true
        filter: "cron.*"
        owner: root
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/spooler:
        sync: true
        filter: "uucp,news.crit"
        owner: root
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
      /var/log/boot.log:
        sync: false
        filter: "local7.*"
        owner: root
        group: adm
        createmode: "0640"
        umask: "0022"
        enabled: true
{%- endload %}
{%- set global = salt['grains.filter_by'](base_defaults, merge=salt['pillar.get']('rsyslog:client')) %}
{%- set server = salt['pillar.get']('rsyslog:server', {}) %}