documentation_complete: true

title: 'Ensure Proper Configuration of Log Files'

description: "The file <tt>/etc/rsyslog.conf</tt> controls where log message are written.\nThese are controlled by lines called <i>rules</i>, which consist of a\n<i>selector</i> and an <i>action</i>.\nThese rules are often customized depending on the role of the system, the\nrequirements of the environment, and whatever may enable\nthe administrator to most effectively make use of log data.\nThe default rules in Red Hat Enterprise Linux 6 are:\n<pre>*.info;mail.none;authpriv.none;cron.none                /var/log/messages\nauthpriv.*                                              /var/log/secure\nmail.*                                                  -/var/log/maillog\ncron.*                                                  /var/log/cron\n*.emerg                                                 *\nuucp,news.crit                                          /var/log/spooler\nlocal7.*                                                /var/log/boot.log</pre>\nSee the man page <tt>rsyslog.conf(5)</tt>\
    \ for more information.\n<i>Note that the <tt>rsyslog</tt> daemon can be configured to use a timestamp format that\nsome log processing programs may not understand. If this occurs, \nedit the file <tt>/etc/rsyslog.conf</tt> and add or edit the following line:</i>\n<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre>"
