Rsyslog: How to Send Logs to a Remote Log Server

Updated: 28 September 2026 · Applies to: rsyslog 8.2x on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

Sending logs from your servers to one central log server keeps them safe when a server fails or is compromised, and lets you search everything in one place. This guide sets up rsyslog on both sides with plain TCP, using the current configuration syntax (the @@server shorthand from older CentOS 6 and 7 guides still works but gives no control over buffering). For logs that cross the internet, add encryption as described in remote rsyslog with TLS. We checked both configurations with rsyslogd -N1 on AlmaLinux 9 (rsyslog 8.2510).

Before you start

• rsyslog is installed by default on AlmaLinux, Rocky Linux, RHEL and Ubuntu. On Debian 13 install it first: apt install rsyslog.
• The log server needs enough disk space, and a firewall rule that only lets your own servers connect.

On the log server

1. Create /etc/rsyslog.d/10-server.conf. It receives logs on TCP port 514 and writes one file per sending host and program:

   module(load="imtcp")
   input(type="imtcp" port="514" ruleset="remote")
   template(name="PerHost" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
   ruleset(name="remote") {
       action(type="omfile" dynaFile="PerHost" fileCreateMode="0640" dirCreateMode="0750")
       stop
   }

   The separate ruleset keeps remote logs out of the server's own /var/log/messages.
2. Check the configuration and restart:

   rsyslogd -N1
   systemctl restart rsyslog

3. Allow only your servers to connect:

   firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" port port="514" protocol="tcp" accept'
   firewall-cmd --reload

   With UFW: ufw allow from 203.0.113.0/24 to any port 514 proto tcp.
4. On AlmaLinux, Rocky Linux and RHEL, SELinux reserves TCP port 514 for the old rsh service, so rsyslog may not listen on it until you relabel the port (from the policycoreutils-python-utils package):

   semanage port -m -t syslogd_port_t -p tcp 514
   systemctl restart rsyslog

   Alternatively use a port that is already labelled for syslog, such as 601 or 20514, on both sides.

On each server that sends logs

1. Create /etc/rsyslog.d/90-forward.conf, with the log server's address:

   *.* action(type="omfwd" target="203.0.113.50" port="514" protocol="tcp"
              queue.type="LinkedList" queue.filename="fwd514" queue.maxDiskSpace="1g"
              queue.saveOnShutdown="on" action.resumeRetryCount="-1")

   The queue settings keep up to 1 GB of logs on disk while the log server is unreachable and send them when it is back, so nothing is lost during an outage.
2. Check and restart:

   rsyslogd -N1
   systemctl restart rsyslog

3. Send a test message: logger "test from $(hostname)". On the log server it appears in /var/log/remote/HOSTNAME/.

Rotate the collected logs

Create /etc/logrotate.d/remote on the log server so the files do not grow without limit:

/var/log/remote/*/*.log {
    weekly
    rotate 12
    compress
    missingok
    notifempty
    sharedscripts
    postrotate
        systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
    endscript
}

Common problems

• Nothing arrives: test the connection from the sending server with nc -zv 203.0.113.50 514, and check journalctl -u rsyslog on both sides.
• Remote logs also appear in /var/log/messages: the input is not bound to the separate ruleset. Check the ruleset="remote" part of the input line.
• Wrong host names in the folders: rsyslog uses the host name the sender puts in each message. Set proper host names with hostnamectl set-hostname.

Official documentation: rsyslog omfwd module and imtcp module.