How to Setup A Centralized Log Server Using Rsyslog on Ubuntu 16.04 LTS

Today, we are going to explain how to setup a Centralized Log Server using Rsyslog onUbuntu 16.04 LTS to manage the logs of your client systems from a common place. You don’t have to visit the client systems when you want to check the log files of your client systems. This can be useful if you have large number of systems on your network and want to do the log management from a centralized dedicated log server.

Environment:

For the purpose of this guide, we will use 2 Ubuntu 16.04 servers, one acts as rsyslog server, and other acts as client.

Rsyslog Server:

OS: Ubuntu 16.04 LTS
IP address: 192.168.1.200
Hostname: logserver.yallalabs.com

Client Server:

OS: Ubuntu 16.04 LTS
IP Address: 192.168.1.201
Hostname: server01.yallalabs.com

Server configuration

– Backup the rsyslog file configuration

lotfi@logserver:~$ cp /etc/rsyslog.conf /etc/rsyslog.conf.orig

– Open the rsyslog file configuration

lotfi@logserver:~$ vi /etc/rsyslog.conf

– Find and uncomment the following lines to make your server to listen on the udp and tcp ports.

[...]
# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")
[...]
# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
[...]

– Create a template file where we will create a new custom log format under the /etc/rsyslog.d/ directory

[root@logserver ~]# vi /etc/rsyslog.d/tmpl.conf

– Add the following lines:

$template TmplAuth, "/var/log/client_logs/%HOSTNAME%/%PROGRAMNAME%.log"
$template TmplMsg, "/var/log/client_logs/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth
*.info;mail.none;authpriv.none;cron.none ?TmplMsg

– Save and close the file.

Allow Rsyslog default port 514 on your firewall. The following commands will open this port via UFW.

[root@logserver ~]# sudo ufw allow 514/tcp
[root@logserver ~]# sudo ufw allow 514/udp

– Restart UFW service to take effect the changes.

[root@logserver ~]# sudo ufw reload

– Finally reload the Rsyslog Service using the following command

[root@logserver ~]# systemctl restart rsyslog

Client configuration

– Backup the rsyslog file configuration

[root@server01 ~]# cp /etc/rsyslog.conf /etc/rsyslog.conf.orig

– Open the rsyslog file configuration

[root@server01 ~]# vi /etc/rsyslog.conf

– Under ##RULES## directive section, add the following line:

[...]
        ##RULES## 
*.* @192.168.1.200:514
[...]

– Finally reload the Rsyslog Service using the following command

[root@server01 ~]# systemctl restart rsyslog

– Let’s log the message to standard error (screen), as well as the system log by using the following command:

[root@server01 ~]# logger -s " This is my Rsyslog client "

– Now go to the Rsyslog Server under the direcotry /var/log/Client_logs you should see a new folder named with the hostname of your Rsyslog client:

[root@logserver ~]# ls -l  /var/log/client_logs/server01/
total 12
-rw-r----- 1 syslog adm  43 Jun 13 20:39 root.log
-rw-r----- 1 syslog adm 307 Jun 13 20:34 su.log
-rw-r----- 1 syslog adm  82 Jun 13 20:34 unix_chkpwd.log

We hope this tutorial was enough Helpful. If you need more information, or have any questions, just comment below and we will be glad to assist you!
 

If you like our content, please consider buying us a coffee. Thank you for your support!