diff --git a/src/freedombone-logging b/src/freedombone-logging
index 3e87fe28..178496c0 100755
--- a/src/freedombone-logging
+++ b/src/freedombone-logging
@@ -90,56 +90,31 @@ function turn_logging_off {
     done
 }
 
-function turn_off_rsys_logging {
-    if ! grep -q '/var/log/auth.log' /etc/rsyslog.conf; then
-        if ! grep -q '/var/log/kern.log' /etc/rsyslog.conf; then
-            return
-        fi
-    fi
-    sed -i 's|mail,news.none.*|mail,news.none      /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|auth,authpriv.\*.*|auth,authpriv.\*         /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|mail.info.*|mail.info            /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|mail.warn.*|mail.warn            /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|mail.err.*|mail.err            /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|daemon.\*.*|daemon.\*              /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|mail.\*.*|mail.\*              /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|user.\*.*|user.\*              /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|kern.\*.*|kern.\*              /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|news.none;mail.none.*|news.none;mail.none /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|\*.\*;auth,authpriv.none.*|\*.\*;auth,authpriv.none      /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|#cron.\*|cron.\*|g' /etc/rsyslog.conf
-    sed -i 's|cron.\*.*|cron.\*             /dev/null|g' /etc/rsyslog.conf
-    $REMOVE_FILES_COMMAND /var/log/wtmp*
-    $REMOVE_FILES_COMMAND /var/log/debug*
-    $REMOVE_FILES_COMMAND /var/log/cron.*
-    $REMOVE_FILES_COMMAND /var/log/auth.*
-    $REMOVE_FILES_COMMAND /var/log/mail.*
-    $REMOVE_FILES_COMMAND /var/log/daemon.*
-    $REMOVE_FILES_COMMAND /var/log/user.*
-    $REMOVE_FILES_COMMAND /var/log/messages*
-    $REMOVE_FILES_COMMAND /var/log/syslog*
-    $REMOVE_FILES_COMMAND /var/log/alternatives*
-    $REMOVE_FILES_COMMAND /var/log/faillog
-    $REMOVE_FILES_COMMAND /var/log/kern.log*
-}
-
 function turn_on_rsys_logging {
-    if grep -q '/var/log/auth.log' /etc/rsyslog.conf; then
-        return
-    fi
-    sed -i 's|mail,news.none.*|mail,news.none      -/var/log/messages|g' /etc/rsyslog.conf
-    sed -i 's|auth,authpriv.\*.*|auth,authpriv.\*         /var/log/auth.log|g' /etc/rsyslog.conf
-    sed -i 's|mail.info.*|mail.info            -/var/log/mail.info|g' /etc/rsyslog.conf
-    sed -i 's|mail.warn.*|mail.warn            -/var/log/mail.warn|g' /etc/rsyslog.conf
-    sed -i 's|mail.err.*|mail.err            /var/log/mail.err|g' /etc/rsyslog.conf
-    sed -i 's|daemon.\*.*|daemon.\*              -/var/log/daemon.log|g' /etc/rsyslog.conf
-    sed -i 's|mail.\*.*|mail.\*              -/var/log/mail.log|g' /etc/rsyslog.conf
-    sed -i 's|user.\*.*|user.\*              -/var/log/user.log|g' /etc/rsyslog.conf
-    sed -i 's|kern.\*.*|kern.\*              -/var/log/kern.log|g' /etc/rsyslog.conf
-    sed -i 's|news.none;mail.none.*|news.none;mail.none -/var/log/debug|g' /etc/rsyslog.conf
-    sed -i 's|\*.\*;auth,authpriv.none.*|\*.\*;auth,authpriv.none      -/var/log/syslog|g' /etc/rsyslog.conf
-    sed -i 's|#cron.\*|cron.\*|g' /etc/rsyslog.conf
-    sed -i 's|cron.\*.*|cron.\*             /var/log/cron.log|g' /etc/rsyslog.conf
+    save_rsys_header
+
+    { echo 'auth,authpriv.*         /var/log/auth.log';
+      echo '*.*;auth,authpriv.none -/var/log/syslog';
+      echo 'cron.*                  /var/log/cron.log';
+      echo 'daemon.*               -/var/log/daemon.log';
+      echo 'kern.*                 -/var/log/kern.log';
+      echo 'lpr.*                  -/var/log/lpr.log';
+      echo 'mail.*                 -/var/log/mail.log';
+      echo 'user.*                 -/var/log/user.log';
+      echo '';
+      echo 'mail.info              -/var/log/mail.info';
+      echo 'mail.warn              -/var/log/mail.warn';
+      echo 'mail.err                /var/log/mail.err';
+      echo '';
+      echo "*.=debug;\\";
+      echo "        auth,authpriv.none;\\";
+      echo '        news.none;mail.none -/var/log/debug';
+      echo "*.=info;*.=notice;*.=warn;\\";
+      echo "        auth,authpriv.none;\\";
+      echo "        cron,daemon.none;\\";
+      echo '        mail,news.none      -/var/log/messages';
+      echo '';
+      echo '*.emerg                         :omusrmsg:*'; } >> /etc/rsyslog.conf
 }
 
 if [ ! "$1" ]; then
diff --git a/src/freedombone-utils-setup b/src/freedombone-utils-setup
index dc1d2aa1..8c40ed8a 100755
--- a/src/freedombone-utils-setup
+++ b/src/freedombone-utils-setup
@@ -223,30 +223,53 @@ function install_backports_kernel {
     fi
 }
 
+function save_rsys_header {
+    { echo "";
+      echo "#################";
+      echo "#### MODULES ####";
+      echo "#################";
+      echo '';
+      echo 'module(load="imuxsock")';
+      echo 'module(load="imklog")';
+      echo '';
+      echo '###########################';
+      echo '#### GLOBAL DIRECTIVES ####';
+      echo '###########################';
+      echo '';
+      echo "\$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat";
+      echo '';
+      echo "\$FileOwner root";
+      echo "\$FileGroup adm";
+      echo "\$FileCreateMode 0640";
+      echo "\$DirCreateMode 0755";
+      echo "\$Umask 0022";
+      echo '';
+      echo "\$WorkDirectory /var/spool/rsyslog";
+      echo '';
+      echo "\$IncludeConfig /etc/rsyslog.d/*.conf";
+      echo '';
+      echo '###############';
+      echo '#### RULES ####';
+      echo '###############';
+      echo ''; } > /etc/rsyslog.conf
+}
+
 function turn_off_rsys_logging {
-    if grep -q '/dev/null' /etc/rsyslog.conf; then
-        return
-    fi
-    sed -i 's|mail,news.none.*|mail,news.none      /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|auth,authpriv.\*.*|auth,authpriv.\*         /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|mail.info.*|mail.info            /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|mail.warn.*|mail.warn            /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|mail.err.*|mail.err            /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|daemon.\*.*|daemon.\*              /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|mail.\*.*|mail.\*              /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|user.\*.*|user.\*              /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|news.none;mail.none.*|news.none;mail.none /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|\*.\*;auth,authpriv.none.*|\*.\*;auth,authpriv.none      /dev/null|g' /etc/rsyslog.conf
-    sed -i 's|#cron.\*|cron.\*|g' /etc/rsyslog.conf
-    sed -i 's|cron.\*.*|cron.\*             /dev/null|g' /etc/rsyslog.conf
-    shred -zu /var/log/wtmp*
-    shred -zu /var/log/debug*
-    shred -zu /var/log/cron.*
-    shred -zu /var/log/auth.*
-    shred -zu /var/log/mail.*
-    shred -zu /var/log/daemon.*
-    shred -zu /var/log/user.*
-    shred -zu /var/log/messages*
+    save_rsys_header
+    echo '*.*     ~' >> /etc/rsyslog.conf
+
+    rm -rf /var/log/wtmp*
+    rm -rf /var/log/debug*
+    rm -rf /var/log/cron.*
+    rm -rf /var/log/auth.*
+    rm -rf /var/log/mail.*
+    rm -rf /var/log/daemon.*
+    rm -rf /var/log/user.*
+    rm -rf /var/log/messages*
+    rm -rf /var/log/syslog*
+    rm -rf /var/log/alternatives*
+    rm -rf /var/log/faillog
+    rm -rf /var/log/kern.log*
 }
 
 function initial_setup {