diff --git a/cookbooks/loki/files/etc/rsyslog.d/30-loki.conf b/cookbooks/loki/files/etc/rsyslog.d/30-loki.conf
new file mode 100644
index 0000000..980eef9
--- /dev/null
+++ b/cookbooks/loki/files/etc/rsyslog.d/30-loki.conf
@@ -0,0 +1,7 @@
+# Log kernel generated promtail log messages to file
+:syslogtag,contains,"loki" /var/log/loki.log
+
+# Uncomment the following to stop logging anything that matches the last rule.
+# Doing this will stop logging kernel generated UFW log messages to the file
+# normally containing kern.* messages (eg, /var/log/kern.log)
+& stop