1. On the remote hobbit SERVERS we send data to the main hobbit SERVER.

# rsyslogd.conf
# 02042010tm

# load the required modules
$ModLoad immark
$ModLoad imudp
$ModLoad imtcp
$ModLoad imuxsock
$ModLoad imklog
$ModLoad imfile

# define some standard items
$InputFileName /var/log/hobbit/notifications.log
$InputFileTag hobbit:
$InputFileStateFile /var/log/rsyslogd/state-file
$InputFileSeverity notice
$InputFileFacility user
$InputRunFileMonitor
$InputFilePollingInterval 4

# send the data
$ActionQueueType LinkedList   
$ActionQueueFileName srvrfwd  
$ActionResumeRetryCount -1   
$ActionQueueSaveOnShutdown on 
user.*  /var/log/rsyslogd/spew
user.*  @@your.main.server.ipaddress:1985


2. On the main hobbit SERVER we accept data from the other systems, including the main system and send it to Noida.
# rsyslogd.conf
# 02042010tm

# load the required modules
$ModLoad immark
$ModLoad imudp
$ModLoad imtcp
$ModLoad imuxsock
$ModLoad imklog
$ModLoad imfile

# start a TCP server on port 1985 to accept messages from other hosts
$InputTCPServerRun 1985
$AllowedSender TCP, 127.0.0.1, 10.10.10.10, 8.9.10.11, 200.255.255.200

# define some standard items
$InputFileName /var/log/hobbit/notifications.log
$InputFileTag hobbit:
$InputFileStateFile /var/log/rsyslogd/state-file
$InputFileSeverity notice
$InputFileFacility user
$InputRunFileMonitor
$InputFilePollingInterval 4

# send the data
$ActionQueueType LinkedList   
$ActionQueueFileName srvrfwd  
$ActionResumeRetryCount -1   
$ActionQueueSaveOnShutdown on 
user.*  /var/log/rsyslogd/spew
user.*  @@1.2.3.4:1985
user.*  @@10.10.1.2:514
user.*  @@10.10.1.3:514
user.*  @@10.10.1.4:514