title: Rsyslog create two listeners (with and without TLS) with omfile as output. Possible or not?
body: <p>I am trying to create a rsyslog.conf with multiple listeners e.g. with and without TLS (with streamdriver). It is possible to create multiple inputs, but as I read in the rsyslog documentation, it seems to be impossible to move the streamdriver parameters e.g. streamdriver.mode="1" from module() to inputs() or to action() when using omfile. Does anybody know if there is a way to <strong>create multiple listeners</strong> with <strong>imtcp</strong> and <strong>omfile</strong> as output method?</p>
  
  <p>my working script for single listener:</p>
  
  <pre><code># Prints every message, even if repeated 1001 times in a second. Strongly recommend for use with Splunk
  $RepeatedMsgReduction off
  
  module(load="imtcp"
      streamdriver.name="gtls" # use gtls netstream driver
      streamdriver.mode="1" # require TLS for the connection
      streamdriver.authmode="x509/name" # server is NOT authenticated
  )
  
  global(
      defaultNetstreamDriverCAFile="/opt/splunk/etc/auth/sslCerts/CACertificate.pem"
      defaultNetstreamDriverCertFile="/opt/splunk/etc/auth/sslCerts/ServerCertificate.pem"
      defaultNetstreamDriverKeyFile="/opt/splunk/etc/auth/sslCerts/ServerPrivatKeyDec.key"
  )
  
  # Create as many inputs as you like. This listens to UDP + TCP 514.
  input(type="imtcp" port="514" ruleset="SplunkNetwork")
  
  
  # Template for directory + filename structure. Use %FROMHOST-IP% for IP without hostname resolution
  template(name="filename-by-host" type="string" string="/opt/logfiles/%FROMHOST%/%$YEAR%-%$MONTH%-%$DAY%.log")
  
  ruleset(name="SplunkNetwork") {
          action(type="omfile" DynaFile="filename-by-host" DirCreateMode="0755" FileCreateMode="0644" DirOwner="splunk" DirGroup="splunk" FileOwner="splunk" FileGroup="splunk")
  }
  </code></pre>
  
  <p>What I want to do - not working - passing the streamdriver parameters to input() or action():</p>
  
  <pre><code># Prints every message, even if repeated 1001 times in a second. Strongly recommend for use with Splunk
  $RepeatedMsgReduction off
  
  module(load="imtcp")
  
  global(
      defaultNetstreamDriverCAFile="/opt/splunk/etc/auth/sslCerts/CACertificate.pem"
      defaultNetstreamDriverCertFile="/opt/splunk/etc/auth/sslCerts/ServerCertificate.pem"
      defaultNetstreamDriverKeyFile="/opt/splunk/etc/auth/sslCerts/ServerPrivatKeyDec.key"
  )
  
  # Create as many inputs as you like. This listens to UDP + TCP 514.
  input(type="imtcp" port="514" ruleset="SplunkNetwork-anon-no-tsl")
  input(type="imtcp" port="1514" ruleset="SplunkNetwork-anon-tsl")
  
  
  # Template for directory + filename structure. Use %FROMHOST-IP% for IP without hostname resolution
  template(name="filename-by-host" type="string" string="/opt/logfiles/%FROMHOST%/%$YEAR%-%$MONTH%-%$DAY%.log")
  
  ruleset(name="SplunkNetwork-anon-no-tsl") {
          action(type="omfile" DynaFile="filename-by-host" DirCreateMode="0755" FileCreateMode="0644" DirOwner="splunk" DirGroup="splunk" FileOwner="splunk" FileGroup="splunk" StreamDriverMode="0" StreamDriver="gtls" StreamDriverAuthMode="anon")
  }
  
  ruleset(name="SplunkNetwork-anon-tsl") {
          action(type="omfile" DynaFile="filename-by-host" DirCreateMode="0755" FileCreateMode="0644" DirOwner="splunk" DirGroup="splunk" FileOwner="splunk" FileGroup="splunk" StreamDriverMode="1" StreamDriver="gtls" StreamDriverAuthMode="anon")
  }
  </code></pre>