remote logging to rsyslog

 

#enable remote access (mind also the firewall)

# provides UDP syslog reception
  module(load="imudp")
  input(type="imudp" port="514")
  
 # provides TCP syslog reception
  module(load="imtcp")
  input(type="imtcp" port="514")

#redirect all expernal traffic to dedicated file

$template remote-incoming-logs,"/var/log/remote/%HOSTNAME%.log"
  :inputname, isequal, "imudp" ?remote-incoming-logs
  :fromhost-ip , !isequal , "127.0.0.1" stop

 

Further reading: here