Playbook
Home / Logging & Syslog / Install

Host the syslog server on AWS EC2

careful advanced #aws#ec2#cloud#security group#elastic ip#vpn

When to use this: You want an always-on syslog server in the cloud for an office or remote site.

Be careful with this one. Never open port 514 to 0.0.0.0/0. Open it only to your firewall's public IP, or use a VPN tunnel.

Before you start

Steps

  1. Launch an Ubuntu instance

    EC2, Launch instance, Ubuntu Server LTS. t3.small is enough for rsyslog; use a larger size for Graylog or Wazuh. Add a gp3 data volume sized for your retention. Use a key pair for SSH.

  2. Create a tight security group

    Inbound rules: SSH 22 from your IP only; UDP and TCP 514 (or 6514 for TLS) from the firewall's public IP only (or from the VPN subnet). No other inbound. Outbound default is fine.

  3. Attach an Elastic IP

    A fixed public address so the firewall configuration never changes after a stop and start. Note that public IPv4 addresses carry an hourly charge.

  4. Install rsyslog

    SSH in and follow the Ubuntu rsyslog scenario. Mount the data volume on /var/log/remote before enabling reception.

  5. Point the FortiGate at the instance

    terminal
    config log syslogd setting
    set status enable
    set server "ELASTIC-IP-OR-VPN-PRIVATE-IP"
    set mode reliable
    set port 514
end

    Use reliable (TCP) over the internet where possible. For a VPN, point to the instance's private IP and set the tunnel as the source interface.

  6. Back up and monitor

    Schedule EBS snapshots, optionally copy old logs to S3 with a lifecycle rule, and set a CloudWatch alarm on disk usage and instance status.

How to verify it worked

  • Logs from the office firewall appear under /var/log/remote/<public-or-tunnel-ip>/.
  • The security group allows the sender's IP only (check with an external port scan from another IP: it must fail).

How to undo it

Terminate the instance, release the Elastic IP and delete the volumes and snapshots, otherwise you keep paying for them.

Common errors and fixes

Logs show the wrong sender IP NAT at the office changes the source address. Allow-list the public IP that AWS actually sees, or use the VPN.
Big bill Check unused Elastic IPs, snapshots, oversized volumes and data transfer out. Set an AWS Budget alert.
Messages are lost during internet blips Use TCP (reliable on FortiGate) and consider a queue on the sender, or a VPN with stable connectivity.

Q&A

Is syslog over the internet safe?

Plain syslog is unencrypted and spoofable. Use a VPN or TLS and restrict the source IP in the security group.

Do I pay for incoming log traffic on AWS?

Inbound data transfer to EC2 is generally free. Outbound is charged, so the cost mostly comes from the instance, storage and the IP address. Verify on the AWS pricing page.

Practice these as flashcards →

Terms in this scenario

Syslog server

Related scenarios

My notes

Saved in this browser only.