Tuning rsyslog

server sideserver side

allow rsyslog to listen on port 514, disable rsyslog facilities localX on messages and enable it only for /data/logs/APPNAME/…

mkdir -p /data/logs/APPNAME/

cd /etc/
cp -pi rsyslog.conf rsyslog.conf.dist
vi rsyslog.conf

# inbound UDP
module(load="imudp")
input(type="imudp" port="514")

# inbound TCP
module(load="imtcp")
input(type="imtcp" port="514")

*.*     /var/log/messages

local1.*    /data/logs/APPNAME/special1.log

client sideclient side

send local logs to syslog server

local1.*    @10.1.0.35:5140

ready to goready to go

systemctl restart rsyslog
systemctl status rsyslog

resourcesresources

https://askubuntu.com/questions/1469805/sending-nginx-logs-to-a-remote-syslog-server ==> to remote server