On the server receiving syslog messages, on UDP port 514, you would need to add the following configuration:
$ModLoad imudp
$UDPServerRun 514
$AllowedSender UDP, 10.42.0.0/15 127.0.0.1
$template RemoteStore, "/var/log/remote/%HOSTNAME%/%timegenerated:1:10:date-rfc3339%"
:source, !isequal, "localhost" -?RemoteStore
:source, isequal, "last" ~
Make sure you allowed the right senders (replace 10.42.0.0/15
), restart rsyslog. Then, you'll find your remote logs in /var/log/remote/$hostname/YYYY-MM-DD
.
In addition / CentOS specifics: there's a fair chance your firewall is enabled. If so, it may be dropping inbound traffic to UDP port 514. Check for your firewall status (systemctl status firewall
). If enabled, try to add a rule.
# firewall-cmd --get-default-zone
public
# firewall-cmd --zone=public --add-port=514/udp
# firewall-cmd --permanent
# firewall-cmd --reload
You might want to check for SELinux. If enabled, make sure it allows rsyslog to receive UDP traffic to port 514.