systemctl status rsyslog
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
$template Incoming-logs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?Incoming-logs
sudo mkdir /var/log/remote-logs
sudo rsyslogd -N1 -f /etc/rsyslog.conf
sudo systemctl restart rsyslog
sudo ss -4tunlp | grep 514
*.* @svc01:514
logger -n 127.0.0.1 -P 514 --rfc3164 "its running!"