Verify if the rsyslog is actually receiving and logging messages from the client, under /var/log, in the form hostname/programname.log.

Run a ls command to long listing of the parent logs directory and check if there is a directory for example called ip-172.31.21.58 (or whatever your client machine’s hostname is).

$ ls -l /var/log/

If the directory exists, check the log files inside it, by running.

sudo ls -l /var/log/ip-172-31-21-58/