Configuring Remote Logging on Linux

Server1 will need to be configured to receive logs via TCP.

Uncomment the following section within /etc/rsyslog.conf:

$ModLoad imtcp
$InputTCPServerRun 514

Then, under the line starting with local7.*, add the following:

$template DynFile,"/var/log/hosts/system-%HOSTNAME%.log"
*.* -?DynFile

Restart the rsyslog service.

Verify the host is listening on port 514.

Open the firewall to permanently permit incoming traffic on TCP port 514 and reload it.

Verify Server2 can connect to Server1 over TCP port 514.

On Server2, modify the /etc/rsyslog.conf file.

Uncomment the following lines:

$ActionQueueFileName fwdRule1 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList   # run asynchronously
$ActionResumeRetryCount -1    # infinite retries if host is down

Uncomment the following line and edit as follows:

*.* @@10.0.1.10:514

Restart the rsyslog service.

Verify the /var/log/hosts directory was created and is being populated.

Use tail on the /var/log/hosts/system-ip-10-0-1-11.log file to see entries from Server2.

You can use the logger command to add entries to the log:

On Server2, enter the following command 3 times:

logger "THIS IS A TEST"

Verify these entries are showing up in the log file on Server1.