How to setup a remote syslog server in CentOS 6

I wanted to have a cisco device send it’s logs to a Centos box for troubleshooting. I just wanted to do a “tail -f” against the error logs. Seems that syslog is now rsyslog in Centos 6. To setup rsyslog to accept syslog logs from other devices, you need to:

1. uncomment out the following lines (not the description lines, the ones that start with “$”)

# Provides UDP syslog reception
$ModLoad imudp.so
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp.so
$InputTCPServerRun 514

2. Add a line or two like these below to say where you want the logs written:

:fromhost-ip,startswith,’192.168.1.’ /var/log/remote.log
& ~
:fromhost-ip,isequal,”192.168.1.33″ /var/log/servername.log
& ~

3. service restart rsyslogd

4. add a hole in iptables for 514 (UDP and TCP)

-A INPUT -m state –state NEW -m udp -p udp –dport 514 -j ACCEPT
-A INPUT -m state –state NEW -m tcp -p tcp –dport 514 -j ACCEPT

5. service iptables restart

6. create a new logrotate.d config file in /etc/logrotate.d:

/var/log/remote.log
{
daily
rotate 5
missingok
notifempty
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

,

13 Responses to How to setup a remote syslog server in CentOS 6

  1. Matthew Millward June 5, 2012 at 4:59 am #

    Hi

    Thanks for the very useful post. I followed your instructions and they worked great on my CentOS box. I just had one issue with the syntax for the firewall rule. Mine reads as:
    iptables -A INPUT -m state –state NEW -m udp -p udp –dport 514 -j accept
    I also realised that this appended the rule to my INPUT chain and appeared after a deny any protocol rule so I deleted the rule and then inserted it in the correct position (in my case rule 5):
    iptables -I INPUT 5 -m state –state NEW -m udp -p udp –dport 514 -j accept

  2. jbmurphy June 6, 2012 at 10:05 am #

    Not sure, I would have to see your whole iptables. I usually just modify the file in /etc/sysconfig/iptables and add the rule I need. Then I issue a service iptables restart. Sorry I could not be of more assistance!

  3. Andree Jacobson August 18, 2012 at 11:40 am #

    Thanks, saved me a bunch of time. Thoughts:

    1) The file is: /etc/rsyslog.conf

    2) Suggest putting the logs entries in separate file:
    /etc/rsyslog.d/remotes.conf

    3) service rsyslog restart

    Cheers,
    Andree

  4. jbmurphy August 20, 2012 at 9:56 am #

    Thanks for taking the time to comment. I agree with your comments below!

  5. Rob October 8, 2012 at 11:35 am #

    thank you for this. saving me time.

  6. Mike M November 15, 2012 at 3:17 pm #

    Very helpful for the server side! Thanks!

    Now how do I send my system logging info from another CentOS box to this one? 😉

  7. jbmurphy December 5, 2012 at 4:19 pm #

    I will try and get a new post out about this soon. But I am sure you found your answer by now.

  8. Praveen December 6, 2012 at 7:45 am #

    Hi, I followed the exact steps and it is not working for me, nothing is logged from my another device on to the CentOS server, is there something that I’m missing here

  9. jbmurphy December 6, 2012 at 8:29 am #

    Firewall?

  10. rizwan January 22, 2013 at 10:52 am #

    i have follwed the same , i am geeting messages from cisco 4506 switch.
    but these mesages are of following type only ” %SYS-5-CONFIG_I: Configured from console by rizwan on vty0 (192.168.22.93) messages include only ”

    i am not geeting other message related to interface updown, mismatch native vlan messgaes.

    i have line as local7.deubug /var/log/switch.log

    can anyone suggest changes so that i would get all messages on my syslog server.

  11. jbmurphy January 29, 2013 at 4:25 pm #

    Sorry, not sure.

  12. Jose Didier June 28, 2013 at 7:12 pm #

    Hi !

    I have a pfsense firewall and I need to monitoring a LAN network, so I need to implement a syslog server, this will be on centos or RHEL.
    I need some help please, do you know how to send logs of pfsense to a remote syslog server *linux* ?

  13. jbmurphy June 28, 2013 at 7:30 pm #

    Sorry. I have not used pfsence. I believe all you would need to do is have it log to the local says long and that can forward? I have played with it in a while