rsyslog Configuration

rsyslog is included by default in Debian and Ubuntu. Enable it via systemctl;

systemctl enable rsyslog

Log Reception

Enable log reception by TCP or UDP, and specify the port number for each. 514 TCP or UDP is the default port for syslog.

module(lead="imudp")
input(type="imudp" port="514")

module(lead="imtcp")
input(type="imtcp" port="514")

Log Storage

Store logs in the filesystem.

$template RemoteLogs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?RemoteLogs