Check if the rsyslog service is running or not with the following command.
sudo systemctl status rsyslog
If it’s not installed, install it and start the service as shown earlier on.
sudo apt update && apt install rsyslog sudo systemctl start rsyslog sudo systemctl enable rsyslog sudo systemctl status rsyslog
Once the rsyslog service is up and running, open the main configuration file where you will perform changes to the default configuration.
sudo vim /etc/rsyslog.conf
To force the rsyslog daemon to act as a log client and forward all locally generated log messages to the remote rsyslog server, add this forwarding rule, at the end of the file as shown in the following screenshot.
*. * @@192.168.100.10:514
The above rule will send messages from all facilities and at all severity levels. To send messages from a specific facility for example auth, use the following rule.
auth. * @@192.168.100.10:514
Save the changes and close the configuration file. To apply the above settings, restart the rsyslog daemon.
sudo systemctl restart rsyslog