Setup Email Alert in rsyslog in linux

# Enable e-mail notification module with ommail
# vim /etc/rsyslog.conf
then add this module

$ModLoad ommail
$ActionMailSMTPServer 10.105.9.85
$ActionMailSMTPPort 25
$ActionMailFrom rsyslog@xm.shv
$ActionMailTo samnang@xm.shv
$template mailSubject,"Rsyslog Alert on %hostname% (%syslogseverity-text%)"
$template mailBody,"Rsyslog ALERT ON: %hostname% (%fromhost%) \r\n\r\nTIME: %timereported% \r\n\r\nSYSLOG EVENT: [%syslogfacility-text%-%syslogseverity-text%] \r\n\r\nMESSAGE: %msg%"
$MainMsgQueueSize 100000
# make sure we receive a mail only once in six
# hours (21,600 seconds ;))
$ActionExecOnlyOnceEveryInterval 0

# the if ... then ... mailBody mus be on one line!
#if $syslogpriority-text contains 'INFO' or $syslogpriority-text contains 'crit' then :ommail:;mailBody
#if $syslogserverity-text =='INFO' then :ommail:;mailBody
#if $fromhost-ip == '10.105.1.22' then :ommail:;mailBody
#if $fromhost-ip == '10.105.1.22' and $syslogseverity-text =='notice' and $msg contains 'logging in' or $msg contains 'loggin out' then :ommail:;mailBody
#if $fromhost-ip == '10.105.1.26' and $syslogseverity-text =='notice' and $msg contains 'logging in' or $msg contains 'loggin out' then :ommail:;mailBody

#if ($fromhost-ip == '10.105.1.22' or $fromhost-ip == '10.105.1.22') and ($syslogtag startswith '%%01SHELL/5/LOGIN' or $syslogtag startswith '%%01SHELL/5/LOGOUT' or $syslogtag startswith '%%01NETCONF/4/LOGIN' or $syslogtag startswith '%%01NETCONF/4/LOGOUT') then :ommail:;mailBody

if $syslogfacility-text == 'local7' and ($msg startswith 'The user succeeded in logging' or $syslogtag startswith '%%01NETCONF/4/LOGIN' or $syslogtag startswith '%%01NETCONF/4/LOGOUT') then :ommail:;mailBody

then restart service syslog

#/etc/init.d/rsyslog restart


==================================================
Reference:
http://www.rsyslog.com/doc/v8-stable/configuration/modules/ommail.html