Logs in one place

Not running Starting usually ~20 s

Step 7 of 7 · summary · 2 min

Summary

rsyslog sorts lines by "selector → action" rules; a line goes through all the rules until stop halts it.
Forwarding is a rule with the collector's address: @@ is TCP, @ is UDP; your rule goes into a file in /etc/rsyslog.d, and rsyslogd -N1 checks the syntax.
A collector takes only the protocols that have a loaded module and an input (imtcp, imudp); a UDP line with no listener is lost silently.
A template with %HOSTNAME% sorts lines by machine using the name in the line's header.
The lab-orders errors were missing from the collector because the machine's rsyslog wrote lines only to its own files and forwarded them nowhere.

Ubuntu 24.04