Our "logserver" host (which is just an alias to our netboot server) runs Ubuntu 12.04 LTS and uses rsyslog.
I've attached our /etc/rsyslog.conf file and the /etc/rsyslog.d/10-remote.conf file. The former is mostly standard but with the three following changes: 1) Enables UDP reception (maybe it was already enabled?) 2) Modifies the default permissions for all log files to be readable by all. 3) Increases some rate limits to handle the influx of messages when a bunch of RAOCHes startup. The 10-remote.conf file has a few lines in there to handle some oddball things on our network that don't always use the right hostname in the syslog message (e.g. our HP V1810 switch). The one line that you will want to change is the "paper2" line. You will want to change "paper2" to the name of your machine that runs rsyslog. The purpose of that line to to prevent local log messages from being treated as remote log messages. Hope this helps, Dave
rsyslog.conf
Description: Binary data
10-remote.conf
Description: Binary data
