I already figured out that I can send log messages from one of the standard log files to another server by adding these lines to /etc/rsyslog.d/50-default.conf (I'm using ubuntu 16.04):
auth,authpriv.* @@73.147.200.188:514
syslog @@73.147.200.188:514
Now, I want to do the same for apf_log but "apf_log @@73.147.200.188:514" doesn't work.
I've already tried dozens of variations of examples for the imfile module (http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html) including both the old & new versions of the commands with no effect.
The closest I got was adding the line "apf_log /var/log/auth.log" which inserted properly formatted log file entries to auth.log from apf_log even if I didn't actually set up imfile. Unfortunately, I couldn't directly send auth.log entries to my remote server either ("auth.log @@73.147.200.188:514" has no effect).
The documentation of rsyslog's imfile module says "This module provides the ability to convert any standard text file into a syslog message". Using a "state file" it detects when new lines appear and passes them "to rsyslog’s rule engine" (which I assume refers to rules like "syslog @@73.147.200.188:514" and "auth,authpriv.* /var/log/auth.log").
However, it doesn't say what the file's variable name is in that rule engine. I've tried using the file name, its full path, and the imfile "tag" value. I also tried matching these settings in the server (73.147.200.188, in this example) and made sure /var/log/apf_log had full permissions (in both machines).
Dustin