diff --git a/cloud-init.changes b/cloud-init.changes
index a5fdcc0..d6a8216 100644
--- a/cloud-init.changes
+++ b/cloud-init.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Jun 26 18:53:21 UTC 2014 - rschweikert@suse.com
+
+- add rsyslog filter rule to send cloud-init messages to
+  /var/log/cloud-init.log
+
 -------------------------------------------------------------------
 Wed Jun 25 22:24:31 UTC 2014 - rschweikert@suse.com
 
diff --git a/cloud-init.spec b/cloud-init.spec
index 2192352..15f07b4 100644
--- a/cloud-init.spec
+++ b/cloud-init.spec
@@ -24,6 +24,7 @@ Url:            http://launchpad.net/cloud-init/
 Group:          System/Management
 Source0:        %{name}-%{version}.tar.gz
 Source1:        cloud.cfg.suse
+Source2:        rsyslog-cloud-init.cfg
 Patch0:         suseSysVInit.diff
 # FIXME addopenSUSEBase.patch proposed for upstream merge
 Patch1:         addopenSUSEBase.patch
@@ -163,6 +164,10 @@ sed -i s/INSERT_SUSE_DISTRO/opensuse/ %{buildroot}/%{_sysconfdir}/cloud/cloud.cf
 %endif
 %endif
 %endif
+%if 0%{?suse_version} && 0%{?suse_version} > 1110
+mkdir %{buildroot}/%{_sysconfdir}/rsyslog.d
+cp -a %{SOURCE2} %{buildroot}/%{_sysconfdir}/rsyslog.d/21-cloudinit.conf
+%endif
 
 # remove debian/ubuntu specific profile.d file (bnc#779553)
 rm -f %{buildroot}%{_sysconfdir}/profile.d/Z99-cloud-locale-test.sh
@@ -217,8 +222,12 @@ popd
 %{systemd_prefix}/systemd/system/cloud-init.service
 %{systemd_prefix}/systemd/system/cloud-final.service
 %endif
+%if 0%{?suse_version} && 0%{?suse_version} > 1110
+%{_sysconfdir}/rsyslog.d/21-cloudinit.conf
+%endif
 %dir %attr(0755, root, root) %{_localstatedir}/lib/cloud
 %dir %{docdir}
+%dir %{_sysconfdir}/rsyslog.d
 
 %files doc
 %defattr(-,root,root)
diff --git a/rsyslog-cloud-init.cfg b/rsyslog-cloud-init.cfg
new file mode 100644
index 0000000..b47ffe5
--- /dev/null
+++ b/rsyslog-cloud-init.cfg
@@ -0,0 +1,6 @@
+# Log cloudinit generated log messages to file
+:syslogtag, isequal, "[CLOUDINIT]" /var/log/cloud-init.log
+
+# comment out the following line to allow CLOUDINIT messages through.
+# Doing so means you'll also get CLOUDINIT messages in /var/log/syslog
+& ~