syslog_forwarder.conf.erb

<% if properties.syslog_aggregator %>
$ModLoad imuxsock                       # local message reception (rsyslog uses a datagram socket)
$MaxMessageSize 4k                      # default is 2k
$WorkDirectory /var/vcap/sys/rsyslog/buffered # where messages should be buffered on disk

# Forward vcap messages to the aggregator
#
$ActionResumeRetryCount -1              # Try until the server becomes available
$ActionQueueType LinkedList             # Allocate on-demand
$ActionQueueFileName agg_backlog        # Spill to disk if queue is full
$ActionQueueMaxDiskSpace 32m            # Max size for disk queue
$ActionQueueLowWaterMark 2000           # Num messages. Assuming avg size of 512B, this is 1MiB.
$ActionQueueHighWaterMark 8000          # Num messages. Assuming avg size of 512B, this is 4MiB. (If this is reached, messages will spill to disk until the low watermark is reached).
$ActionQueueTimeoutEnqueue 0            # Discard messages if the queue + disk is full
$ActionQueueSaveOnShutdown on           # Save in-memory data to disk if rsyslog shuts down
:programname, startswith, "vcap." @@<%= properties.syslog_aggregator.address %>:<%= properties.syslog_aggregator.port %>

# Log vcap messages locally, too
#$template VcapComponentLogFile, "/var/log/%programname:6:$%/%programname:6:$%.log"
#$template VcapComponentLogFormat, "%timegenerated% %syslogseverity-text% -- %msg%\n"
#:programname, startswith, "vcap." -?VcapComponentLogFile;VcapComponentLogFormat

# Prevent them from reaching anywhere else
:programname, startswith, "vcap." ~
<% end %>