Forwarding Data From rsyslog

Question

We have set up a centralized syslog server (RHEL 7 running rsyslogd) that receives syslog data from most of our hosts. Our Security team wants to receive data as well. I'd prefer not to duplicate the connection to the syslog server with the same data going to Security's log server. I'm looking for a syslog server configuration that will just pass the data it receives from all hosts on to Security's log analyzer in order to minimize changes on 1,000+ hosts.

Answer 1

From the existing central log server (RHEL-7), append the following lines to the /etc/rsyslog.conf file

*.* @X.X.X.X:514
*.* @@X.X.X.X:514

Where X.X.X.X is the hostname or IP address to the new log server that resides within the security team. Single @ symbol means UDP while double @@ symbols mean TCP and 514 is the destination port. UDP is the preferred delivery method as far logs are concerned. Finally restart rsyslog on the existing server.

$ sudo systemctl restart rsyslog

Then hop over to the new syslog server (Security Team) and configure it to accept logs: Edit the file /etc/rsyslog.conf and uncomment the following two lines:

$ModLoad imudp 
$UDPServerRun 514

Then restart rsyslog service

$ sudo systemctl restart rsyslog

Then add rsyslog to the firewall exceptions

$ sudo firewall-cmd --permanent --add-port=514/tcp
$ sudo firewall-cmd --permanet --add-port=514/udp
$ sudo firewall-cmd --reload

The RHEL-7 central log server will continue receiving logs from the 1000+ hosts, at the same time relaying all logs to the new server residing in Security Team.

Once its working, then you can consider using rsyslog with SSL for confidentiality