--=========准备========
1.firewall状态检查
firewall-cmd --state
2.停止和禁用
systemctl stop firewalld.service
systemctl disable firewalld.service
3.检查服务
systemctl status firewalld.service
4.检查iptables
systemctl status iptables.service
systemctl stop iptables.service
--==========配置=========
1.打开配置文件
vim /etc/rsyslog.conf
2.启用rsyslog从UDP 514端口接收日志
$ModLoad imudp
$UDPServerRun 514
3.启用rsyslog从TCP 514端口接收日志
$ModLoad imtcp
$InputTCPServerRun 514
4.创建一个日志接收模板
在GLOBAL DIRECTIVES块前，加入
$template RemoteLogs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log" *
*.*? ?RemoteLogs
备注：
The "& ~" sign represents a redirect rule, and is used to tell rsyslog daemon to stop processing log messages further, and not write them locally. If this redirection is not used, all the remote messages would be also written on local log files besides the log files described above, which means they would practically be written twice. Another consequence of using this rule is that the syslog server‘s own log messages would only be written to dedicated files named after machine‘s hostname.
加入规则：
#记录所有日志类型的info级别以及大于info级别的信息，但是mail邮件信息，authpriv验证方面的信息和cron时间任务相关的信息除外
*.info,mail.none,authpriv.none,cron.none??? ?RemoteLogs
5.
systemctl restart rsyslog
6.
netstat -tulpn | grep rsyslog
原文：http://blog.51cto.com/ultrasql/2148903