Install a syslog server on Ubuntu (rsyslog)

Steps

1. Install rsyslog (it is usually preinstalled)

   terminalCopy

   sudo apt update
   sudo apt install -y rsyslog

   Ubuntu normally ships rsyslog already. This makes sure it is present and current.

2. Create the folder for remote logs

   terminalCopy

   sudo mkdir -p /var/log/remote
   sudo chown syslog:adm /var/log/remote
   sudo chmod 750 /var/log/remote

   rsyslog runs as user syslog and cannot create folders directly under /var/log, so create it first.

3. Add the receiver configuration

   terminalCopy

   sudo tee /etc/rsyslog.d/10-remote.conf > /dev/null <<'EOF'
   # Listen for syslog from the network
   module(load="imudp")
   input(type="imudp" port="514")
   module(load="imtcp")
   input(type="imtcp" port="514")
   
   # One folder per sender IP, one file per day
   template(name="PerHostDaily" type="string"
            string="/var/log/remote/%fromhost-ip%/%$year%-%$month%-%$day%.log")
   # Keep arrival time and sender IP, then the original line
   template(name="LineFmt" type="string"
            string="%timegenerated:::date-rfc3339% %fromhost-ip% %rawmsg%\n")
   
   # Everything not from this machine goes to the per-host files and stops there
   if $fromhost-ip != '127.0.0.1' then {
       action(type="omfile" dynaFile="PerHostDaily" template="LineFmt"
              dirCreateMode="0750" fileCreateMode="0640")
       stop
   }
   EOF

   Opens UDP and TCP 514, writes each sender to /var/log/remote/<sender-ip>/<date>.log, and keeps those messages out of the local /var/log/syslog. The file starts with 10- so it runs before Ubuntu's default rules.

   Check the heredoc kept its indentation. If you pasted with leading spaces, rsyslog still accepts them, but the EOF line must be at the start of the line.

4. Check the configuration syntax

   terminalCopy

   sudo rsyslogd -N1

   Validates the config without restarting. Fix any error before continuing.

   Expected output

   rsyslogd: version 8.x, config validation run (level 1), master config /etc/rsyslog.conf
   rsyslogd: End of config validation run. Bye.

5. Restart and confirm it is listening

   terminalCopy

   sudo systemctl restart rsyslog
   sudo ss -lunp | grep ':514'
   sudo ss -ltnp | grep ':514'

   -lun lists UDP listeners and -ltn TCP ones. You should see rsyslogd on port 514 in both.

6. Open the firewall for your senders only

   terminalCopy

   sudo ufw allow from 192.168.1.1 to any port 514 proto udp
   sudo ufw allow from 192.168.1.1 to any port 514 proto tcp
   sudo ufw status

   Replace 192.168.1.1 with each sender's IP. Skip this if ufw is not enabled, but then make sure another firewall limits access.

7. Send a test message from another machine

   terminalCopy

   logger -n 192.168.1.10 -P 514 -d "syslog test from $(hostname)"

   Run it on any Linux box (replace the server IP). -d uses UDP. Then read the file on the server in the next step.

8. Read the received logs

   terminalCopy

   ls /var/log/remote/
   sudo tail -f /var/log/remote/*/$(date +%Y-%m-%d).log

   You should see a folder per sender IP and new lines arriving. Press Ctrl+C to stop.

9. Set up retention (compress after 1 day, delete after 90)

   terminalCopy

   sudo tee /etc/cron.daily/remote-logs-clean > /dev/null <<'EOF'
   #!/bin/sh
   find /var/log/remote -type f -name '*.log' -mtime +1 -exec gzip -q {} \;
   find /var/log/remote -type f -name '*.gz' -mtime +90 -delete
   EOF
   sudo chmod +x /etc/cron.daily/remote-logs-clean

   Change 90 to your retention in days. Text logs typically compress very well, which saves disk.