как правильно настроить, чтобы журнал отправлялся на другой хост.

       Valid facility names are: auth, authpriv (for security information of a sensitive nature), cron, daemon, ftp, kern (can't be  generated  from  user
       process), lpr, mail, news, security (deprecated synonym for auth), syslog, user, uucp, and local0 to local7, inclusive.

       Valid   level   names  are:  alert, crit, debug, emerg, err, error  (deprecated  synonym  for  err), info, notice, panic  (deprecated  synonym  for
       emerg), warning, warn (deprecated synonym for warning).  For the priority order and intended purposes of these levels, see syslog(3).