Configure the server. Open /etc/rsyslog.conf and add/modify:
# Provides UDP syslog reception
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
$template RemoteLogs,"/db/log/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?RemoteLogs
& ~
# adjust this line - they can be multiple (on the server and clients):
# add local6.none to exclude list
# that does not allow to log to multiple locations
*.info;mail.none;authpriv.none;cron.none;local6.none /var/log/messages
Save and restart rsyslog:
systemctl restart rsyslog.service
Configure the client. Create a new configuration at /etc/rsyslog.d/22-client.conf:
module(load="imfile" PollingInterval="10")
input(type="imfile" File="/var/log/nginx/access.log" Tag="nginx-access:" Severity="notice" Facility="local6" ReadMode="2" reopenOnTruncate="on")
input(type="imfile" File="/var/log/nginx/error.log" Tag="nginx-error:" Severity="notice" Facility="local6" ReadMode="2" reopenOnTruncate="on")
input(type="imfile" File="/var/log/php-fpm/php-fpm.log" Tag="php-fpm:" Severity="notice" Facility="local6" ReadMode="2" reopenOnTruncate="on")
local6.* @above.server.tld:514
Save and restart rsyslog:
systemctl restart rsyslog.service
Check the server path for new logs:
ls -la /db/log/client.hostname/