Linux Administration Cookbook

Remote logging with rsyslog - UDP example

In order to enable logging to a remote machine with rsyslog, you need to enable both streaming to a remote location on your client, and receiving on your server.

For this, centos1 will be our client, and centos2 will be our server.

On centos1 first:

$ sudo sed -i 's/#*.* @@remote-host:514/*.* @192.168.33.11/g' /etc/rsyslog.conf$ sudo systemctl restart rsyslog

Now on  centos2: 

$ sudo sed -i 's/#$ModLoad imudp/$ModLoad imudp/g' /etc/rsyslog.conf$ sudo sed -i 's/#$UDPServerRun 514/$UDPServerRun 514/g' /etc/rsyslog.conf$ sudo systemctl restart rsyslog

We can check this is working immediately with tcpdump on our centos2 VM; start it using the following command:

$ sudo tcpdump port 514 -i eth1

Now, generate ...