Results 1 to 6 of 6

Thread: Rsyslog forward log to other syslog server

Hybrid View

  1. #1
    Join Date
    Sep 2012
    Beans
    94
    Distro
    Ubuntu 12.04 Precise Pangolin

    Rsyslog forward log to other syslog server

    Hi All,

    I want to ask. How we can forward text file from rsyslog server to another syslog server using syslog.
    Last edited by termvrl; June 7th, 2013 at 01:38 PM.

  2. #2
    Join Date
    Nov 2012
    Location
    Halloween Town
    Beans
    Hidden!
    Distro
    Xubuntu Development Release

    Re: Rsyslog forward log to other syslog server


  3. #3
    Join Date
    Sep 2012
    Beans
    94
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Rsyslog forward log to other syslog server

    Hi slickymaster,

    i still cannot fwd the syslog,
    What i try to do, i setup 2 rsyslog server, rsyslog1 and rsyslog2.
    My firewall logs forward to rsyslog1 using syslog udp514, i manage to receive the log ar rsyslog1.
    At rsyslog1, i do some log correlation. the result is output to file "output.txt".
    I want to forward the result to the rsyslog2.

    Here my rsyslog.conf file.

    Code:
    root@ubuntu:/etc# more rsyslog.conf
    
    $ModLoad imuxsock # provides support for local system logging
    $WorkDirectory /home/rsyslog/sec-2.7.2/output.txt
    $ModLoad imklog   # provides kernel logging support (previously done by rklogd)
    #$ModLoad immark  # provides --MARK-- message capability
    
    # provides UDP syslog reception
    $ModLoad imudp
    $UDPServerRun 514
    
    # provides TCP syslog reception
    #$ModLoad imtcp
    #$InputTCPServerRun 514
    
    ##########################
    #### GLOBAL DIRECTIVES ####
    ###########################
    
    #
    # Use traditional timestamp format.
    # To enable high precision timestamps, comment out the following line.
    #
    $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
    
    # Filter duplicated messages
    #$RepeatedMsgReduction on
    
    #
    # Set the default permissions for all log files.
    #
    $FileOwner adm
    $FileGroup adm
    $FileCreateMode 0640
    $DirCreateMode 0755
    $Umask 0022
    $PrivDropToUser adm
    $PrivDropToGroup adm
    
    #
    # Where to place spool files
    #
    $ActionQueueType LinkedList   # use asynchronous processing
    $ActionQueueFileName srvrfwd  # set file name, also enables disk mode
    $ActionResumeRetryCount -1    # infinite retries on insert failure
    $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
    *.*       @@192.168.0.124:514
    #
    # Include all config files in /etc/rsyslog.d/
    #
    $IncludeConfig /etc/rsyslog.d/*.conf

    Thanks for your help.

  4. #4
    Join Date
    Nov 2012
    Location
    Halloween Town
    Beans
    Hidden!
    Distro
    Xubuntu Development Release

  5. #5
    Join Date
    Sep 2012
    Beans
    94
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Rsyslog forward log to other syslog server

    Hi

    Thanks
    Now i can receive the logs.
    the problem with this line,

    *.* @@192.168.0.124:514


    @@ == send using TCP.

    My syslog server listening on UDP.

    So, i change to

    *.* @192.168.0.124:514

    Thanks!

  6. #6
    Join Date
    Nov 2012
    Location
    Halloween Town
    Beans
    Hidden!
    Distro
    Xubuntu Development Release

    Re: Rsyslog forward log to other syslog server

    You're welcome. Glad you got it fixed.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •