kazulog@sv1:~$ cat /etc/os-release | head -2
PRETTY_NAME="Ubuntu 26.04 LTS"
NAME="Ubuntu"
kazulog@sv1:~$ ls -l /etc/rsyslog.conf /etc/rsyslog.d/
-rw-r--r-- 1 root root 1319 Sep 12 08:33 /etc/rsyslog.conf

/etc/rsyslog.d/:
total 16
-rw-r--r-- 1 root root  316 Sep 12 08:32 10-remote.conf
-rw-r--r-- 1 root root  314 May 16  2023 20-ufw.conf
-rw-r--r-- 1 root root  255 Jul 24 01:34 21-cloudinit.conf
-rw-r--r-- 1 root root 1124 Aug 22  2025 50-default.conf
kazulog@sv1:~$ grep -vE '^(#|$)' /etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")
$AllowedSender UDP, 192.168.100.1/32
$AllowedSender TCP, 192.168.100.1/32
module(load="imklog" permitnonkernelfacility="on")
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
kazulog@sv1:~$ cat /etc/rsyslog.d/10-remote.conf
# 送信元ホストごとにファイルを分ける
template(name="RemoteFile" type="string" string="/var/log/remote/%HOSTNAME%/messages.log")
ruleset(name="remote") {
    action(type="omfile" dynaFile="RemoteFile")
}
input(type="imudp" port="514" ruleset="remote")
input(type="imtcp" port="514" ruleset="remote")
kazulog@sv1:~$ systemctl is-enabled rsyslog; systemctl is-active rsyslog
enabled
active
kazulog@sv1:~$ sudo ss -ulnp 'sport = :514'
State               Recv-Q              Send-Q                           Local Address:Port                             Peer Address:Port              Process
UNCONN              0                   0                                      0.0.0.0:514                                   0.0.0.0:*                  users:(("rsyslogd",pid=5887,fd=7))              
UNCONN              0                   0                                      0.0.0.0:514                                   0.0.0.0:*                  users:(("rsyslogd",pid=5887,fd=5))              
UNCONN              0                   0                                         [::]:514                                      [::]:*                  users:(("rsyslogd",pid=5887,fd=8))              
UNCONN              0                   0                                         [::]:514                                      [::]:*                  users:(("rsyslogd",pid=5887,fd=6))              
kazulog@sv1:~$ sudo ss -tlnp 'sport = :514'
State               Recv-Q              Send-Q                           Local Address:Port                            Peer Address:Port              Process
LISTEN              0                   25                                     0.0.0.0:514                                  0.0.0.0:*                  users:(("rsyslogd",pid=5887,fd=9))               
LISTEN              0                   25                                        [::]:514                                     [::]:*                  users:(("rsyslogd",pid=5887,fd=10))              
kazulog@sv1:~$ sudo ls -l /var/log/remote/ /var/log/remote/192.168.100.1/ /var/log/remote/sv2/
/var/log/remote/:
total 12
drwx------ 2 syslog syslog 4096 Sep 12 08:32 192.168.100.1
drwx------ 2 syslog syslog 4096 Sep 12 08:32 sv2
drwx------ 2 syslog syslog 4096 Sep 12 08:32 ubuntu

/var/log/remote/192.168.100.1/:
total 4
-rw-r--r-- 1 syslog syslog 1017 Sep 12 08:33 messages.log

/var/log/remote/sv2/:
total 4
-rw-r--r-- 1 syslog syslog 158 Sep 12 08:32 messages.log