---
title: How to Set Up Syslog for Centralized Logging
description: "Setting up **Syslog** for centralized logging allows you to collect and analyze logs from multiple servers in a single location, improving visibility and management of system events. Here’s a guide on configuring a centralized Syslog server and client. ### What…"
url: "https://truehost.com/support/knowledge-base/how-to-set-up-syslog-for-centralized-logging/"
updated: "2024-11-02"
category: Cloud servers in Kenya
---

# How to Set Up Syslog for Centralized Logging

Setting up **Syslog** for centralized logging allows you to collect and analyze logs from multiple servers in a single location, improving visibility and management of system events. Here’s a guide on configuring a centralized Syslog server and client.

### What is Syslog?

**Syslog** (System Logging Protocol) is a standard protocol for message logging in Unix and Linux systems. It provides a mechanism for log data collection and storage, where multiple clients send logs to a centralized server for monitoring and analysis.

---

### Prerequisites

- **Syslog Server** (central server where logs will be stored)
- **Syslog Clients** (machines that will send their logs to the central server)
- **Root or sudo access** on both the server and clients

---

### Step 1: Set Up the Centralized Syslog Server

1. **Install rsyslog** (if it’s not already installed):

**On Debian/Ubuntu:**

```
sudo apt updatesudo apt install -y rsyslog
```

**On RHEL/CentOS:**

```
sudo yum install -y rsyslog
```

2. **Configure rsyslog to receive logs over the network**:

Open the `rsyslog` configuration file:

```
sudo vi /etc/rsyslog.conf
```

Uncomment or add the following lines to enable TCP and UDP log reception:

```
# Provides TCP syslog reception
module(load="imtcp")   # Load TCP input module
input(type="imtcp" port="514")

# Provides UDP syslog reception
module(load="imudp")   # Load UDP input module
input(type="imudp" port="514")
```

3. **Specify a Log Directory for Incoming Logs** (optional but recommended):

By default, logs will be written to `/var/log/syslog` or `/var/log/messages`. You can create a custom directory for each client’s logs by editing `rsyslog.conf`:

```
# Custom rule for incoming logs
template(name="RemoteLogs" type="string" string="/var/log/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?RemoteLogs
```

4. **Save and close** the file, then **restart rsyslog**:

```
sudo systemctl restart rsyslog
```

5. **Allow Syslog Traffic through the Firewall**:

- Open ports for UDP and TCP on port 514 (if using both):

**For Ubuntu/Debian**

```
sudo ufw allow 514/tcp

sudo ufw allow 514/udp
```

**For firewalld (Almalinux/CentOS/RHEL):**

```
sudo firewall-cmd --permanent --add-port=514/tcp
sudo firewall-cmd --permanent --add-port=514/udp
sudo firewall-cmd --reload
```

### Step 2: Configure Syslog Clients to Send Logs to the Central Server

1. **Install rsyslog** on each client (if it’s not already installed):

```
sudo apt update && sudo apt install -y rsyslog # For Debian/Ubuntu

sudo yum install -y rsyslog # For RHEL/CentOS
```

2. **Configure the client to send logs to the central server**:

- Open the `rsyslog` configuration file:

```
sudo vi /etc/rsyslog.conf
```

Add the following lines at the end of the file to forward logs to the central Syslog server (replace `<server_ip>` with your server’s IP address):

```
*.* @<server_ip>:514    # For UDP

*.* @@<server_ip>:514   # For TCP
```

For example:

```
*.* @192.168.1.10:514
```

3. **Save and close** the file, then **restart rsyslog** on the client:

```
sudo systemctl restart rsyslog
```

### Step 3: Verify Centralized Logging

1. **Generate a Test Log Entry** on the client:Run the following command on the client to generate a sample log entry:

```
logger "Test log entry from client"
```

2. **Check Logs on the Server**:

On the Syslog server, look in `/var/log/` or in the directory you specified. For example:

```
sudo tail -f /var/log/syslog
```

Or, if you configured a custom directory:

```
sudo ls /var/log/<client_hostname>/

sudo tail -f /var/log/<client_hostname>/test.log
```

You should see the test log entry from the client.

### Step 4: Optional - Setting Up Log Rotation (Recommended)

To prevent the central log server from filling up with logs, set up log rotation.

1. **Edit or create a log rotation file** (for custom logs):

```
sudo nano /etc/logrotate.d/remote-logs
```

2. **Add the following configuration** for log rotation:

```
/var/log/*/*.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 0640 syslog adm
    sharedscripts
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}
```

This configuration will rotate logs daily, keep seven days’ worth of logs, and compress old logs to save space.

### Author's final word

You have successfully set up a centralized Syslog server to collect logs from multiple Linux clients. This setup can help streamline log management, enhance monitoring, and enable centralized log analysis for better insights into your systems’ health and security.