rsyslog Central Log Server: Receive and Forward Logs

When you manage more than a handful of Linux servers, switches and firewalls, ssh-ing into each box to read logs stops working - and when a server dies, its logs die with it. An rsyslog central log server collects syslog from every device into per-host directories, giving you one searchable place for troubleshooting and audits. rsyslog is pre-installed on most distributions, so the whole project is two small config files: one on the collector to receive, one on each client to forward. This guide covers both sides with Ubuntu commands.

Step 1: Configure the Collector (Server Side)

Create /etc/rsyslog.d/10-remote-logs.conf on the log server to load the UDP and TCP input modules and organize remote logs per hostname and program:

module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")

$template RemoteLogs,"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log"
:source, !isequal, "localhost" -?RemoteLogs
:source, !isequal, "localhost" stop

Then restart and open the firewall port:

sudo systemctl restart rsyslog
sudo ufw allow 514/tcp
sudo ufw allow 514/udp

UDP is the traditional syslog transport but can lose messages under load; TCP guarantees delivery and is the recommended choice for production. rsyslog's modern RainerScript syntax can also write this with action(type="omfile" dynaFile="RemoteLogs").

Step 2: Forward Logs from Clients

On every client create /etc/rsyslog.d/50-forward-logs.conf. A single @ means UDP, @@ means TCP:

# Forward everything over TCP to the central server
*.* @@192.168.1.100:514

Selective forwarding works with facility/severity selectors or property filters:

auth,authpriv.* @@log-server.example.com:514   # only auth logs
*.err @@log-server.example.com:514             # errors and above
if $programname == 'nginx' then @@log-server.example.com:514

sudo systemctl restart rsyslog

Step 3: Test the Pipeline

Send a test message from a client and confirm it lands on the collector:

logger -p local0.info -t shipdemo "central pipeline test"
# on the collector:
sudo grep "central pipeline test" /var/log/remote/*/*.log

Also validate the collector config before restarting with sudo rsyslogd -N1 and confirm the listener with sudo ss -tlnp | grep 514.

Hints for Network Devices

The same collector accepts logs from switches and firewalls: point their syslog server setting at the collector IP and they appear under their hostname in /var/log/remote/. Add logrotate for /var/log/remote/*/*.log - centralized logs grow fast.

Related Guides on This Site

Keep the time on all those devices consistent with chrony NTP sync and drift troubleshooting, and for monitoring stack alternatives see Prometheus snmp_exporter monitoring.

原文链接：https://www.redhat.com/en/blog/log-aggregation-rsyslog