/etc/rsyslog.d/
/var/spool/rsyslog/