Playbook
Home / Logging & Syslog / Connect sources

Forward a Linux server's logs to the syslog server

safe beginner #linux#rsyslog#forward#client#omfwd

When to use this: A Linux machine should also send its logs to the central server.

Before you start

Steps

  1. Add the forwarding rule

    terminal
    sudo tee /etc/rsyslog.d/90-forward.conf > /dev/null <<'EOF'
*.* action(type="omfwd" target="192.168.1.10" port="514" protocol="tcp"
           action.resumeRetryCount="-1"
           queue.type="LinkedList" queue.size="10000"
           queue.filename="fwd_syslog" queue.saveOnShutdown="on")
EOF

    Sends all logs to the server over TCP. The disk-assisted queue holds messages while the server is down and resends later (resumeRetryCount="-1" retries forever). For UDP use protocol="udp".

  2. Validate and restart

    terminal
    sudo rsyslogd -N1
sudo systemctl restart rsyslog

    Syntax check first.

  3. Send a test line

    terminal
    logger "forwarding test from $(hostname)"

    It should arrive in the server's folder for this client's IP.

How to verify it worked

  • A folder for the client's IP exists on the server and shows the test line.

How to undo it

Remove the rule and restart:

terminal
sudo rm /etc/rsyslog.d/90-forward.conf
sudo systemctl restart rsyslog

Common errors and fixes

Nothing arrives over TCP The server may only listen on UDP, or its firewall blocks TCP 514. Check ss -ltnp on the server.

Q&A

Why a queue on the client?

So messages are not lost when the server or network is down. The client stores them and sends when the connection returns.

What does *.* mean?

Every facility and every severity.

Practice these as flashcards →

Terms in this scenario

Syslog server

Related scenarios

My notes

Saved in this browser only.