yum install rsyslog
vi /etc/rsyslog.conf
# Provides UDP syslog reception
$ModLoad imudp.so
$UDPServerRun 514
# Provides TCP syslog reception
$ModLoad imtcp.so
$InputTCPServerRun 514
$template RemoteHost,"/data/syslog/%$YEAR%-%$MONTH%-%$DAY%/%FROMHOST-IP%.log"
:fromhost-ip, !isequal, "127.0.0.1" ?RemoteHost
service iptables stop
service rsyslog restart