diff --git a/terraform/control-plane1.bu b/terraform/control-plane1.bu
index f3f3cfc..8a35ffb 100644
--- a/terraform/control-plane1.bu
+++ b/terraform/control-plane1.bu
@@ -23,6 +23,9 @@ storage:
       mode: 0755
     - path: /var/lib/undercloud-stamps
       mode: 0755
+    - path: /var/lib/rsyslog
+      overwrite: true
+  mode: 0755
 
   files:
     - path: /etc/hostname
@@ -165,6 +168,28 @@ storage:
         inline: |
           [Journal]
           ForwardToSyslog=yes
+     
+    - path: /etc/rsyslog.conf
+  mode: 0644
+  contents:
+    inline: |
+      # Minimal rsyslog: receive from journald syslog socket and forward to remote
+
+      global(workDirectory="/var/lib/rsyslog")
+
+      # This is the important part: pick up what journald forwards when ForwardToSyslog=yes
+      module(load="imuxsock" SysSock.Name="/run/systemd/journal/syslog")
+
+      # Forward everything to your syslog server (TCP recommended)
+      action(
+        type="omfwd"
+        target="syslog.undercloud.local"
+        port="514"
+        protocol="tcp"
+        action.resumeRetryCount="-1"
+        queue.type="linkedList"
+        queue.size="50000"
+      )
 
     - path: /etc/kubernetes/kubeadm-init.yaml
       mode: 0644
@@ -266,6 +291,22 @@ storage:
 
 systemd:
   units:
+    - name: rsyslog.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=rsyslog (journald -> remote syslog)
+        Wants=network-online.target
+        After=network-online.target systemd-journald.service
+
+        [Service]
+        Type=simple
+        ExecStart=/opt/bin/rsyslogd -n -f /etc/rsyslog.conf
+        Restart=always
+        RestartSec=2
+
+        [Install]
+        WantedBy=multi-user.target
     # --- Boot entrypoint: only this target is enabled at boot ---
     - name: undercloud-bootstrap.target
       enabled: true