Linux Security Cookbook

9.29. Logging Remotely

Problem

You want system logger messages saved on a remote machine rather than locally.

Solution

Configure /etc/syslog.conf for remote logging, using the “@” syntax:

               /etc/syslog.conf:
# Send all messages to remote system "loghost"
*.*             @loghost

On loghost, tell syslogd to accept messages from the network by adding the -r option:

# syslogd -r ...

or within /etc/sysconfig/syslog:

SYSLOGD_OPTIONS="... -r ..."   Red Hat
SYSLOGD_PARAMS="... -r ..."    SuSE

Remember to send a signal to syslogd to pick up any changes to /etc/syslog.conf [Recipe 9.27], or to restart the daemon on loghost if you have changed command-line options.

Discussion

The system logger can redirect messages to another machine: this is indicated in /etc/syslog.conf by an "@” character followed by a machine name as the destination. Our recipe shows a simple remote logging configuration that sends all messages to a remote machine, conventionally named loghost .

The remote configuration can be convenient for collecting messages from several machines in log files on a single centralized machine, where they can be monitored and examined. You might also want to use this configuration on a machine like a web server, so that log files cannot be read, tampered with, or removed by an intruder if a break-in occurs.

Local and remote rules can be combined in the same syslog.conf configuration, and some categories of messages can be sent to both local and remote destinations.

The system logger will not accept messages from ...