An rsyslog rule defines how to process a specific log message and consists of two fundamental components. The first is a filter (also known as a selector), which specifies the conditions a message must meet to be selected, such as its facility (e.g., kern, mail) and priority level (e.g., info, err). The second component is the action, which defines what to do with the selected message, such as writing it to a specific file, sending it to a remote server, or discarding it. This filter-action structure forms the basis of all rules in the rsyslog.conf file.

C. parser: A parser is a component that interprets the structure and content of a log message, but it is not a direct part of the rule's filter/action syntax.

D. module: Modules extend rsyslog functionality (e.g., for input or output). While an action may utilize a module, the module itself is not a primary component of the rule's syntax.

E. security policy: A security policy is a high-level set of rules and procedures. It is not a syntactic component used to construct an individual rsyslog rule.

1. Oracle Linux 8 Documentation: Managing Core System Configuration

Chapter 22. Viewing and Managing Log Files

Section 22.3.1. Understanding the rsyslog.conf file format. The documentation states

"Each rule consists of two fields: a selector field and an action field... The selector field

also called a filter

specifies a message source and a priority level."

2. rsyslogd Official Documentation: The documentation for rsyslog.conf format specifies the basic rule structure. "Every rule line consists of two parts: a selector and an action... The selector

now also called filter

specifies which messages to select for the action." (Reference: rsyslog.com

Documentation

Configuration

rsyslog.conf).

3. Linux man pages: The rsyslog.conf(5) man page

available on Oracle Linux systems

describes the rule format. Under the "RULES" section

it details that lines are composed of a "Filter Part" and an "Action Part".