Rsyslog forward log to other syslog server

[termvrl]

Hi All,

I want to ask. How we can forward text file from rsyslog server to another syslog server using syslog.

[slickymaster]

Reliable Forwarding of syslog Messages with Rsyslog

[termvrl]

Hi slickymaster,

i still cannot fwd the syslog,
What i try to do, i setup 2 rsyslog server, rsyslog1 and rsyslog2.
My firewall logs forward to rsyslog1 using syslog udp514, i manage to receive the log ar rsyslog1.
At rsyslog1, i do some log correlation. the result is output to file "output.txt".
I want to forward the result to the rsyslog2.

Here my rsyslog.conf file.

root@ubuntu:/etc# more rsyslog.conf

$ModLoad imuxsock # provides support for local system logging
$WorkDirectory /home/rsyslog/sec-2.7.2/output.txt
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

##########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
#$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner adm
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser adm
$PrivDropToGroup adm

#
# Where to place spool files
#
$ActionQueueType LinkedList   # use asynchronous processing
$ActionQueueFileName srvrfwd  # set file name, also enables disk mode
$ActionResumeRetryCount -1    # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
*.*       @@192.168.0.124:514
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

Thanks for your help.

[slickymaster]

How do I configure rsyslog to send logs from a specific program to a remote syslog server?
Forwarding to other syslog
How to Setup Rsyslog Remote Logging on Linux
Sending messages to a remote syslog server

[termvrl]

Hi

Thanks
Now i can receive the logs.
the problem with this line,

*.* @@192.168.0.124:514


@@ == send using TCP.

My syslog server listening on UDP.

So, i change to

*.* @192.168.0.124:514

Thanks!

[slickymaster]

You're welcome. Glad you got it fixed.