Forwarding Logs¶

rsyslog can forward log messages to remote servers. This is often done to centralize logs, improve analysis, or send data to SIEM or monitoring systems.

Minimal Forwarding Example (TCP)¶

Add the following snippet to your /etc/rsyslog.conf or to a file inside /etc/rsyslog.d/:

# Forward all messages to a remote server using TCP.
# The linked-list queue prevents blocking if the server is temporarily unreachable.
action(
    type="omfwd"              # Output module for forwarding messages
    protocol="tcp"            # Use TCP (reliable transport)
    target="logs.example.com" # Destination server (replace with your host)
    port="514"                # TCP port on the remote syslog server
    queue.type="linkedList"   # Best practice for network forwarding
)

Why use queue.type=”linkedList”?¶

When a remote server goes offline, a direct TCP forwarding action can block and delay local logging. Using a queue ensures that messages are stored temporarily and sent once the connection recovers. This is a recommended default for TCP-based forwarding.

Forwarding via UDP¶

UDP is a connectionless protocol and does not block, so queues are not required in this case. To forward messages via UDP, modify the protocol:

# Forward all messages to a remote server using UDP.
action(
    type="omfwd"
    protocol="udp"            # UDP (unreliable, but lower overhead)
    target="logs.example.com"
    port="514"
)

Testing the Connection¶

To verify that logs are reaching the remote server:

Send a test message locally: .. code-block:: bash

logger “test message from $(hostname)”
Check the remote server’s logs for the test message.

Advanced Queue Tuning¶

The default queue parameters work for most cases. For high performance or large bursts of logs, you can adjust settings such as:

queue.size – Number of messages stored in the queue.
queue.dequeueBatchSize – Number of messages processed per batch.

See General Queue Parameters for details.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project