Well I see a few people checking this question out and I figured out how to do it. So I'll make a small beginner's guide to rsyslog.
If you just want to forward syslog data to a remote server:
Add this line to the bottom of
/etc/rsyslog.d/50-default.conf (based on protocol):
*.* @remoteserverIP:PORT #usually port 514
*.* @@remoteserverIP:PORT #usually port 514
Add these lines to a
.conf file you create in
$InputFileName /var/log/test #change this to desired input
$InputFileTag test #change filetag
$InputFileSeverity info #log severity
*.* @remoteserverIP:PORT #change to remote server
sudo service rsyslog restart
Then on the remote (logging) server you need to edit the
/etc/rsyslog.conf file to listen for traffic. The top of the file will have these sections:
# provides UDP syslog reception
# provides TCP syslog reception
Uncomment the section for the appropriate protocol.
At the end of the file you'll probably want to include some sort of filtering template so the logs get parsed out into files based on where they came from. Here's an example:
Save the file and restart the service on this machine.
Hopefully this works for all of you!