Which two components are used for creating a new rsyslog rule?

An rsyslog rule defines how to process a specific log message and consists of two fundamental components. The first is a filter (also known as a selector), which specifies the conditions a message must meet to be selected, such as its facility (e.g., kern, mail) and priority level (e.g., info, err). The second component is the action, which defines what to do with the selected message, such as writing it to a specific file, sending it to a remote server, or discarding it. This filter-action structure forms the basis of all rules in the rsyslog.conf file.

C. parser: A parser is a component that interprets the structure and content of a log message, but it is not a direct part of the rule's filter/action syntax.
D. module: Modules extend rsyslog functionality (e.g., for input or output). While an action may utilize a module, the module itself is not a primary component of the rule's syntax.
E. security policy: A security policy is a high-level set of rules and procedures. It is not a syntactic component used to construct an individual rsyslog rule.

1. Oracle Linux 8 Documentation: Managing Core System Configuration, Chapter 22. Viewing and Managing Log Files, Section 22.3.1. Understanding the rsyslog.conf file format. The documentation states, "Each rule consists of two fields: a selector field and an action field... The selector field, also called a filter, specifies a message source and a priority level."

2. rsyslogd Official Documentation: The documentation for rsyslog.conf format specifies the basic rule structure. "Every rule line consists of two parts: a selector and an action... The selector, now also called filter, specifies which messages to select for the action." (Reference: rsyslog.com, Documentation, Configuration, rsyslog.conf).

3. Linux man pages: The rsyslog.conf(5) man page, available on Oracle Linux systems, describes the rule format. Under the "RULES" section, it details that lines are composed of a "Filter Part" and an "Action Part".