PlaybookLogging & Syslog
What a syslog server is, which one to pick, how to install it, how to feed it FortiGate and ESXi logs.
Basics
What is syslog and what is a syslog server?
Someone asks what a syslog server is, why they would need one, and what it does.
Facility, severity, ports and protocols (UDP, TCP, TLS)
You need to read a syslog message header, pick a port, or decide between UDP, TCP and TLS.
Syslog server vs log collector vs SIEM: what is the difference?
A customer says they need 'a syslog server', but it is unclear whether they want storage, search, or security alerts.
Answer 'what is syslog?' to a customer (ready-made answers)
A customer or colleague asks the typical questions and you want short, correct answers.
Choose a solution
Which syslog solution should I pick? (by scenario)
You need to recommend a setup and justify it by size, budget and what the customer wants to do with the logs.
Syslog software compared (features, cost model, best for)
You want a side-by-side comparison of the common syslog servers and log platforms.
Where to host it: local PC, VMware VM, standalone server or AWS?
You know the software, but need to decide where the syslog server should physically run.
Estimate the cost: software, hosting and disk
A customer asks 'how much will it cost?' and you need a defensible estimate.
Install
Install a syslog server on Ubuntu (rsyslog)
You want a free, reliable syslog server on Ubuntu that stores each device's logs in its own daily file.
Install a syslog server on Windows
You want to receive syslog on a Windows machine, for example because there is no Linux host.
Install a syslog server on macOS (lab use)
You only have a Mac and want to receive syslog for a demo or learning.
Run the syslog server as a VMware VM (Workstation or ESXi)
You have VMware (Workstation, Fusion or ESXi) and want a dedicated, snapshot-friendly syslog VM on the LAN.
Add searchable dashboards with Graylog (Docker)
Plain files are not enough and you want a web UI to search, filter and chart syslog.
Host the syslog server on AWS EC2
You want an always-on syslog server in the cloud for an office or remote site.
Connect sources
Send FortiGate logs to a syslog server
You have a FortiGate firewall and want its logs delivered to your syslog server.
FortiGate: which logs get sent (policy logging and filters)
The syslog server receives only some logs, or too many, and you want to control what the FortiGate generates and sends.
Send VMware ESXi logs to a syslog server
You want ESXi host logs stored centrally instead of on the host's small local log area.
Forward a Linux server's logs to the syslog server
A Linux machine should also send its logs to the central server.
Get Windows event logs into a syslog server
Windows servers or PCs need to appear in the central log store, but Windows does not speak syslog natively.
Network & security
Open the right ports (Ubuntu, Windows, AWS)
The server is configured but the firewall blocks messages, or you must open ports safely.
Make syslog secure (allow-list, VPN or TLS)
Logs cross an untrusted network (internet, shared network) and must not be readable or forgeable.
Operate
Troubleshoot
No scenario matches that filter.