rsyslog is the logging daemon behind most traditional Linux system logging — even on systemd-based distros where journald handles the initial capture, rsyslog often still processes and routes those logs.
# Route all authentication logs to a dedicated file auth,authpriv.* /var/log/auth-custom.log # Send everything from a specific application to its own log :programname, isequal, "myapp" /var/log/myapp.log & stop # Forward all logs to a remote syslog server (centralized logging) *.* @@logserver.example.com:514
sudo systemctl restart rsyslog sudo rsyslogd -N1 # test config syntax before restarting
Why Centralize Logs at All
Forwarding logs to a central server (via the @@ syntax above for TCP, or @ for UDP) means logs survive even if the originating server is compromised or wiped — a genuinely important property for security incident investigation, since local logs alone can be tampered with by whoever compromised the machine.