syslog_forwarder.conf.erb

<% if_p("syslog_aggregator.address", "syslog_aggregator.port") do |address, port| %>

$ModLoad imuxsock                       # local message reception (rsyslog uses a datagram socket)
$MaxMessageSize 4k                      # default is 2k
$WorkDirectory /var/vcap/sys/rsyslog/buffered  # where messages should be buffered on disk

# Forward vcap messages to the aggregator
#
$ActionResumeRetryCount -1              # Try until the server becomes available
$ActionQueueType LinkedList             # Allocate on-demand
$ActionQueueFileName agg_backlog        # Spill to disk if queue is full
$ActionQueueMaxDiskSpace 32m            # Max size for disk queue
$ActionQueueLowWaterMark 2000           # Num messages. Assuming avg size of 512B, this is 1MiB.
$ActionQueueHighWaterMark 8000          # Num messages. Assuming avg size of 512B, this is 4MiB. (If this is reached, messages will spill to disk until the low watermark is reached).
$ActionQueueTimeoutEnqueue 0            # Discard messages if the queue + disk is full
$ActionQueueSaveOnShutdown on           # Save in-memory data to disk if rsyslog shuts down

template(name="CfLogTemplate" type="list") {
        constant(value="<")
        property(name="pri")
        constant(value=">")
        property(name="timestamp" dateFormat="rfc3339")
        constant(value=" <%= spec.networks.send(properties.network_name).ip %> ")
        property(name="programname")
        constant(value=" [job=")
        property(name="programname")
        constant(value=" index=<%= spec.index.to_i %>] ")
        property(name="msg")
}

:programname, startswith, "vcap." @@<%= address %>:<%= port %>;CfLogTemplate

# Prevent them from reaching anywhere else
:programname, startswith, "vcap." ~

<% if properties.syslog_aggregator.all %>
*.*  @@<%= address %>:<%= port %>
<% end %>

<% end.else do %>

# Prevent them from reaching anywhere else
:programname, startswith, "vcap." ~

<% end %>