3

Previously we were using one Logging server. But now we have added one extra Logging server which will also be storing logs received from client . I need to know how to add these two Syslog servers on client's syslog.conf file. So that both syslog servers receive the logs at same time.

Thanks

1 Answer 1

8

As you have not specified, and also for the benefit of other readers, I will describe what to do using syslog-ng and rsyslog to have a server logging simultaneously to two remote syslog servers.

If you have syslog-ng logging to a central syslog server, modify /etc/syslog-ng.conf

As an example:

source s_src { unix-dgram("/dev/log"); internal();
         file("/proc/kmsg" program_override("kernel"));
};

destination d_loghost {udp("10.10.1.1" port(514));};
log { source(s_src); destination(d_loghost); };

To syslog to a 2nd destination, add:

destination d_loghost2 {udp("10.10.1.2" port(514));};
log { source(s_src); destination(d_loghost2); };

If running rsyslog, then actually it is simpler.The configuration file is /etc/rsyslog.conf

Where you find a destination:

*.* @10.10.1.1:514

you add a 2nd destination:

*.* @10.10.1.2:514

After changing the configuration, the syslog daemons in the client side need to be restart. Being it respectively,

sudo service syslog-ng restart

or

sudo service rsyslog restart

As the syslog daemon sends all messages to all destinations configured, unless you explicitly filter out services or log levels, you do not need to configure anything else [in the client side]. Both will receive exactly the same logs.

5
  • 1
    FYI for other folks who may stumble across this. syslogd is virtually the same as rsyslog. The same procedure can be done for /etc/syslog.conf
    – Mike B
    Jul 18, 2016 at 18:36
  • Can you tell why it sends one packet per minute when specify 127.0.0.1 udp 514 as destination?
    – watou
    Sep 29, 2020 at 10:43
  • @watou Please read our FAQ and open new questions with your issues/queries. Sep 29, 2020 at 11:10
  • How do I setup rsyslog to send all logs to multiple remote servers? and its answer imply that you cannot have just multiple actions as described for rsyslog. Can someone clarify?
    – pt1
    Feb 14, 2023 at 14:31
  • @pt1 would advise opening a new question Feb 15, 2023 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .