Tuning rsyslog

server side

allow rsyslog to listen on port 514, disable rsyslog facilities localX on messages and enable it only for /data/logs/APPNAME/…

mkdir -p /data/logs/APPNAME/

cd /etc/
cp -pi rsyslog.conf rsyslog.conf.dist
vi rsyslog.conf

# inbound UDP
module(load="imudp")
input(type="imudp" port="514")

# inbound TCP
module(load="imtcp")
input(type="imtcp" port="514")

*.*     /var/log/messages

local1.*        /data/logs/APPNAME/special1.log

client side

send local logs to syslog server

local1.*    @10.1.0.35:5140

ready to go

systemctl restart rsyslog
systemctl status rsyslog

resources

https://askubuntu.com/questions/1469805/sending-nginx-logs-to-a-remote-syslog-server ==> to remote server