Updated: 22 October 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9
Ubuntu 14.04 is end of life; these steps are for Ubuntu 24.04 and AlmaLinux 9 / Rocky Linux 9, which all use rsyslog. Sending logs to a central server keeps them safe if a server is compromised and makes searching easier.
On the log server
Create /etc/rsyslog.d/10-remote.conf:
module(load="imtcp")
input(type="imtcp" port="514")
template(name="PerHost" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
if $fromhost-ip != "127.0.0.1" then {
action(type="omfile" dynaFile="PerHost")
stop
}
Restart rsyslog and allow port 514/tcp only from your servers (for example ufw allow from 203.0.113.0/24 to any port 514 proto tcp). On AlmaLinux/Rocky also run semanage port -l | grep syslog to confirm 514 is allowed.
On each client
Create /etc/rsyslog.d/90-forward.conf:
*.* action(type="omfwd" target="logs.example.com" port="514" protocol="tcp"
queue.type="LinkedList" queue.filename="fwd" action.resumeRetryCount="-1")
Restart rsyslog. The queue keeps messages while the log server is unreachable. Test with logger "test from $(hostname)".
Rotate the collected logs
Add /var/log/remote/*/*.log to a logrotate file (for example daily, keep 30, compress).
Note: This sends logs unencrypted. Across the internet, use rsyslog's TLS support (gtls driver) or a VPN between the servers.
