All over the web I find examples for either (1) rsyslog to a remote server or (2) rsyslog with templates, but never both. When I have this /etc/rsyslog.conf on my Mac it sends to the remote server fine:
*.* @10.1.38.223
But when I change to this, no network traffic is sent out to the remote server (verified with tcpdump):
$template MyTemplate, "MacOSX %msg%"
*.* @10.1.38.223;MyTemplate
Is it not possible to append extra text like this to messages logged remotely?
Best Answer
As mentionned by @SYN, the syntax is correct for rsyslog, but not syslogd.
As far as I can tell from https://linux.die.net/man/5/syslog.conf and https://linux.die.net/man/8/syslogd, there is no option to format your logs.
But that isn't necessarily an issue: assuming you have rsyslog on your remote server, you can apply the template there. Either to incoming events, or only to the events you are actually going to keep.
If you have several different OSes you are pulling logs from, doing that might end up being simpler to manage, too.