So, I have rsyslog 8.29 on my server. I need to set up a pretty basic syslog server. I don't need mysql database or web access, I just need a syslog server with ability to accept logs from multiple clients, and store them in separate directories for each client.

I have gone into the rsyslog.conf file and uncommented the udp/tcp 514 lines. I cannot telnet to see if it is listening, I'm guessing a hardware firewall port needs opening. Would that be port 514 for tcp/udp? Basically, no route to host, error.

Other info is that these clients are on different subnets from the server.
I can telnet from different subnets to the host, so rsyslog is listening on port 514. I know, turn off telnet, it was just to check connection.

Also, specific info would be appreciated. I know some redhat, but by far am not an expert.

This job is for syslog-ng. You will find a lot of examples.

Well, I have rsyslog set up as far as receiving logs. While I could look at syslog-ng, I'd rather not spend the time undoing what I have, just to do something else. At this point, I just need to final puzzle piece of modifying the rsyslog.conf to put logs into their own files. I'm sure I;ve been close on my syntax for it, just not exact, yet.