Forwarding logs from rsyslog client to a remote rsyslogs server

• • Network connectivity between client and remote server
  • DefinedKnown IP address of the remote Rsyslog server
  • Open network ports (typically 514 for UDP or TCP)

Step-by-Step Configuration Guide

Preparation
Before beginning, ensure you have:

• • Administrative (root) access
  • Stable network connection
  • IP address of the remote server

Step 1: In the Rsyslog Client (machine)Configuration

 

1. To1.1 loginObtain asRoot rootAccess
   
   just

   

   type : sudo i-
• • • • Enter your root password when prompted
      • Type:
      sudo
    yum
    update
  &&
yum
install

 rsyslog,1.2 Note:Update pleaseSystem verifyPackages



if



syslog

 1.3 Install Rsyslog



Verification Tip Confirm Rsyslog is installed successfully

installed.

 

2. Type1.4 theStart followingand commandsEnable forRsyslog rsyslogService
   
   
   
   
   
   
   
   
   
   
   
   Client

    :1.5 systemctl start rsyslog and systemctl enable rsyslog
   

3. Check theRsyslog statusStatus
   
   
   of

    the

   rsyslog

   Expected usingResult:** this command: systemctl status rsyslog                                 Note: ItService should be in an active state
   

### Step 2: InRsyslog theServer Configuration

#### 2.1 Edit Rsyslog ServerConfiguration

1. Type this command  to edit : ```bash
   vim /etc/rsyslog.conf

```

2. #### 2.2 Enable UDP and TCP Modules
   - Find and uncomment the following lines ifby enabled $Modload imusock and $Modload imjournal

3. Findremoving the lines`#` symbol:
     ```
     $Modload imudp
    and $UDPServerRun 514
    and enable it. Note: (Remove the # sign to enable it)
4. in the line below find the lines $Modload imtcp
    and $inputTCPServerRun 514
    514 and```
   enable

   #### it.2.3 Note:Configure (RemoveLog Template
   - Add the #following signline to enabledefine it)

log
5. Addstorage:
    this line```
    below
    $template RemoteLogs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
     * .*  ?RemoteLogs
    
    & ~
    ~
6. Save```
   the

   #### file.

2.4
7. TypeApply thisServer command: Configuration
   ```bash
   systemctl restart rsyslog 
                                             setenforce Permissive
                                             systemctl disable firewalld
                                             systemctl stop firewalld

### Step 3: InFinal theClient Configuration

#### 3.1 Modify Client Rsyslog Client

1. Type this command : Configuration
   ```bash
   vim /etc/rsyslog.conf

```
2. Insert

   #### this3.2 Add Remote Server Logging Rule
   - Insert the following line (replace `ServerIP` with actual IP):
     ```
     *.* (ServerIP:port)@ServerIP:514
     and```

   save

####

3. Type3.3 thisRestart commandRsyslog :on Client
   ```bash
   systemctl restart rsyslog
   ```

####

4. Now3.4 typeVerify Log Directory
   ```bash
   ls -l /var/log
   ```
   **Expected Result:** 
   - Should see a directory with the command:client's lshostname
   - Contains files like `rsyslogd.log` and `systemd.log`

   ## Troubleshooting Tips
   -1

5. ItEnsure firewall settings allow log forwarding
   - Verify network connectivity between client and server
   - Check Rsyslog service status if logs aren't forwarding

   ## Security Considerations
   - Configure firewall rules appropriately
   - Use encrypted log transmission when possible
   - Regularly review and rotate logs

   ## Common Issues
   1. **Port Blocking:** Ensure port 514 is open
   2. **Permission Errors:** Verify root/sudo access
   3. **Network Connectivity:** Check server IP and network settings

   ## Recommended Best Practices
   - Keep Rsyslog updated
   - Use strong authentication
   - Implement log rotation
   - Encrypt log transmissions

   ## Conclusion
   By following these steps, you should have thesuccessfully configured Rsyslog for log forwarding between a client hostname directory  and undera thatremote folder it should have  (rsyslogd.log) directory

**Note:** Always test in a controlled environment first and adapt instructions to your specific system configuration.