journald forwarding and remote collection: ForwardToSyslog, systemd-journal-upload/-remote, and rate limits

Goal

Get journal entries from a host off that host, either by handing them to the local syslog stack (for onward rsyslog forwarding) or by shipping them directly to a remote journal collector, without silently losing entries to journald's internal rate limiter.

Prerequisites

Root access; systemd with the systemd-journal-upload/systemd-journal-remote packages installed if using direct shipping; a certificate pair if using HTTPS (the tools support plain HTTP too, not recommended across an untrusted network).

Steps

1. To feed an existing rsyslog/syslog pipeline, set in /etc/systemd/journald.conf or a drop-in under /etc/systemd/journald.conf.d/: ForwardToSyslog=yes. This makes journald pass every entry to the traditional syslog socket, per journald.conf(5); rsyslog's imuxsock module then picks it up like any other syslog source. Upstream the default is no; Debian and Ubuntu patch it to yes. RHEL's rsyslog reads the journal directly with imjournal, so no change is needed there.
2. To ship journal data directly, configure the sender: /etc/systemd/journal-upload.conf sets URL=https://collector.example.org:19532 per journal-upload.conf(5). Start and enable systemd-journal-upload.service, whose description states it uploads journal entries to the URL given by --url=/URL=, reading from local journal files and continuing to send new entries as they appear.
3. On the collector, enable systemd-journal-remote.socket (port 19532 by default); systemd-journal-remote.service receives journal data in the journal export format described in its own man page and writes it to journal files under /var/log/journal/remote/. Configure its TLS key/certificate in /etc/systemd/journal-remote.conf (ServerKeyFile=, ServerCertificateFile=, TrustedCertificateFile=).
4. Check journald's own rate limiter before relying on either path for completeness: RateLimitIntervalSec= and RateLimitBurst= in journald.conf(5) state that once a service logs more than RateLimitBurst= messages within RateLimitIntervalSec= (default 10000 messages in 30 seconds, scaled up by a factor based on free journal disk space), further messages from that service within the interval are dropped; journald then logs a "Suppressed N messages from <unit>" entry. Dropped entries never reach any forwarding path, local or remote. Raise the burst value, set it to 0 (disabled), or override it per unit with LogRateLimitIntervalSec=/LogRateLimitBurst= for services expected to log heavily during incidents.
5. Apply changes: systemctl restart systemd-journald for journald.conf, systemctl restart systemd-journal-upload for journal-upload.conf.

Expected result

journalctl -u systemd-journal-upload -f shows no repeated connection errors; on the collector, journalctl -D /var/log/journal/remote --list-boots shows entries from the remote host's boot IDs.

Limits and test basis

Based on journald.conf(5), journal-upload.conf(5), systemd-journal-upload.service(8) and systemd-journal-remote.service(8). To undo, stop and disable the unit and remove the drop-in file. A noisy service hitting the rate limit will show gaps at both the source and any remote collector — search for "Suppressed" in the journal first when entries appear missing rather than assuming a network problem.