Install a syslog server on macOS (lab use)

careful intermediate #macos#syslog-ng#homebrew#lab

When to use this: You only have a Mac and want to receive syslog for a demo or learning.

Be careful with this one. macOS is fine for a demo but not a good always-on log server. Do not rely on it for compliance logs.

Before you start

macOS has its own unified logging system. It does not act as a network syslog receiver, so you install syslog-ng (or run a Linux VM or container).
Homebrew is installed. Apple Silicon Macs use /opt/homebrew, Intel Macs use /usr/local.
Ports below 1024 need root. For a demo, use port 5514 and set the device to send to 5514.

Steps

Install syslog-ng
terminal
```
brew install syslog-ng
```
Installs the open-source edition.

Write a minimal receiver config

terminal

mkdir -p /opt/homebrew/var/log/remote
cat > /opt/homebrew/etc/syslog-ng.conf <<'EOF'
@version: current
source s_net {
  network(transport("udp") port(5514));
  network(transport("tcp") port(5514));
};
destination d_remote {
  file("/opt/homebrew/var/log/remote/${SOURCE_IP}/${YEAR}-${MONTH}-${DAY}.log" create-dirs(yes));
};
log { source(s_net); destination(d_remote); };
EOF

Receives UDP and TCP on 5514 and writes one folder per sender IP. On Intel Macs replace /opt/homebrew with /usr/local. Replace @version: current with the exact version your syslog-ng --version prints if it complains.

Check the config and start it
terminal
```
syslog-ng --syntax-only
brew services start syslog-ng
```
Syntax check first, then run it as a background service.
Allow incoming connections

When macOS asks whether syslog-ng may accept incoming connections, click Allow, or add it under System Settings, Network, Firewall.
Keep the Mac awake while collecting
terminal
```
caffeinate -s
```
Prevents sleep while the command runs (leave the terminal open). Sleeping Macs drop all logs.

How to verify it worked

Send a test from another machine and see the file appear under the remote log folder.

How to undo it

Stop the service:

terminal

brew services stop syslog-ng

Common errors and fixes

Permission denied binding to port 514 Use a port above 1024 such as 5514, or run with sudo (not recommended for a long-running service).

Nothing arrives macOS firewall is blocking it, or the device's port still says 514 while you listen on 5514.

Q&A

Why not just use the Mac's built-in logging?

Apple's unified logging (log command) is for the Mac's own logs. It does not collect syslog from other devices.

Better alternative on a Mac?

Run an Ubuntu VM (UTM, VMware Fusion or Docker) with rsyslog. It matches production and survives sleep better if hosted elsewhere.

Practice these as flashcards →

Terms in this scenario

Syslog server

Related scenarios

My notes

Saved in this browser only.