Linux Administration Cookbook

Remote logging with rsyslog - TCP example

The previous example covered UDP, which is simply a stream of information with no confirmation that the server on the other side received the noise. With a TCP connection, the syslog servers communicate with each other to establish a connection first.

On your centos1 machine, replace the single @ sign in your destination address with two @@ signs:

$ sudo sed -i 's/*.* @192.168.33.11/*.* @@192.168.33.11/g' /etc/rsyslog.conf$ sudo systemctl restart rsyslog

Our client is now set, but no logs can be sent until the connection is established.

On centos2, let's set the rsyslog server to receive TCP connections and data:

$ sudo sed -i 's/#$ModLoad imtcp/$ModLoad imtcp/g' /etc/rsyslog.conf$ sudo sed -i 's/#$InputTCPServerRun ...