Linux Networking Cookbook

19.19. Building a Syslog Server

Problem

You want to have a central network logging server, but the mossy old Linux syslog isn't really up to the job. It's OK for host logging, but it's not as flexible as it could be, and its remote logging capability is not built-in—it's a bit of a hack job, really. You want a modern log server that is designed for network logging, has encryption, and that lets you fine-tune your settings.

You have your SSL certificates and stunnel all configured and ready to go, so now you want to set up Syslog-ng itself.

Solution

Install Syslog-ng on Debian with this command:

	# aptitude install syslog-ng

And on Fedora with this command:

	# yum install syslog-ng

These will automatically remove the old syslog and set up a default configuration that mimics a standard syslog installation.

You must install Syslog-ng, OpenSSL, and stunnel on all client hosts as well, so if you haven't done this yet, see the previous three recipes.

We don't want to make a lot of changes to the existing /etc/syslog-ng/syslog-ng.conf file, so let's start with the options section on the Syslog-ng server:

	options {
	     sync (0);
	     log_fifo_size (2048);
	     time_reopen(10);
	     time_reap(360);
	     create_dirs (yes);
	     perm (0640);
	     dir_perm (0750);
	     chain_hostnames(0);
	     use_dns(no);
	     use_fqdn(no);
	     };

Add these lines to the source section to tell Syslog-ng to listen for messages via stunnel, and to give each remote host its own file in /var/log/hosts/:

 source stunnel {tcp(ip("127.0.0.1")port(514) max-connections(1));}; destination ...