Quick rsyslog setup

On the Server:

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

Add "- 4" to /etc/sysconfig/rsyslog to get it to listen on IPv4 addresses.  Example:
SYSLOGD_OPTIONS="-c 5 -4"

Restart the service

On the Client:

*.* @@remote-host:514

On EC2 instance boot, pass this to user-data:

#!/bin/bash

echo '*.* @@host_name_or_ip:514' >> /etc/rsyslog.conf

/etc/init.d/rsyslog restart