Mastering Linux Security and Hardening - Second Edition

Hands-on lab – setting up a basic log server

Setting up the server is identical on Ubuntu and CentOS. There's only one minor difference in setting up the clients. For best results, ensure that the server VM and the client VM each have a different hostname:

1. On the log-collecting server VM, open the /etc/rsyslog.conf file in your favorite text editor and look for these lines, which are near the top of the file:

# Provides TCP syslog reception#module(load="imtcp") # needs to be done just once#input(type="imtcp" port="514")

2. Uncomment the bottom two lines and save the file. The stanza should now look like this:

# Provides TCP syslog receptionmodule(load="imtcp") # needs to be done just onceinput(type="imtcp" port="514")

3. Restart the rsyslog ...