To forward all logs from rsyslog to syslog-ng, add at the end of file /etc/rsyslog.conf:

*.* @@(o)log.server.tld:601;RSYSLOG_SyslogProtocol23Format

  • @@ is for sending logs via TCP on port 601

  • (o) configures proper framing

  • RSYSLOG_SyslogProtocol23Format adds the RFC5424 template

Using the RFC5424 syslog protocol with plain TCP between rsyslog and syslog-ng: https://www.balabit.com/blog/using-rfc5424-syslog-protocol-plain-tcp-rsyslog-syslog-ng/