{"id":16581,"date":"2024-11-02T09:48:46","date_gmt":"2024-11-02T09:48:46","guid":{"rendered":"https:\/\/truehost.com\/support\/?post_type=docs&#038;p=16581"},"modified":"2024-11-02T09:49:23","modified_gmt":"2024-11-02T09:49:23","password":"","slug":"how-to-set-up-syslog-for-centralized-logging","status":"publish","type":"docs","link":"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/","title":{"rendered":"How to Set Up Syslog for Centralized Logging"},"content":{"rendered":"\n<p>Setting up <strong>Syslog<\/strong> for centralized logging allows you to collect and analyze logs from multiple servers in a single location, improving visibility and management of system events. Here\u2019s a guide on configuring a centralized Syslog server and client.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is Syslog?<\/h3>\n\n\n\n<p><strong>Syslog<\/strong> (System Logging Protocol) is a standard protocol for message logging in Unix and Linux systems. It provides a mechanism for log data collection and storage, where multiple clients send logs to a centralized server for monitoring and analysis.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisites<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Syslog Server<\/strong> (central server where logs will be stored)<\/li>\n\n\n\n<li><strong>Syslog Clients<\/strong> (machines that will send their logs to the central server)<\/li>\n\n\n\n<li><strong>Root or sudo access<\/strong> on both the server and clients<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Set Up the Centralized Syslog Server<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Install rsyslog<\/strong> (if it\u2019s not already installed):<\/li>\n<\/ol>\n\n\n\n<p><strong>On Debian\/Ubuntu:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update<br>sudo apt install -y rsyslog<\/code><\/pre>\n\n\n\n<p><strong>On RHEL\/CentOS:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install -y rsyslog<\/code><\/pre>\n\n\n\n<p>  2. <strong>Configure rsyslog to receive logs over the network<\/strong>:<\/p>\n\n\n\n<p>Open the <code>rsyslog<\/code> configuration file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vi \/etc\/rsyslog.conf<\/code><\/pre>\n\n\n\n<p>Uncomment or add the following lines to enable TCP and UDP log reception:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Provides TCP syslog reception\nmodule(load=\"imtcp\")   # Load TCP input module\ninput(type=\"imtcp\" port=\"514\")\n\n# Provides UDP syslog reception\nmodule(load=\"imudp\")   # Load UDP input module\ninput(type=\"imudp\" port=\"514\")\n<\/code><\/pre>\n\n\n\n<p>3. <strong>Specify a Log Directory for Incoming Logs<\/strong> (optional but recommended):<\/p>\n\n\n\n<p>By default, logs will be written to <code>\/var\/log\/syslog<\/code> or <code>\/var\/log\/messages<\/code>. You can create a custom directory for each client\u2019s logs by editing <code>rsyslog.conf<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Custom rule for incoming logs\ntemplate(name=\"RemoteLogs\" type=\"string\" string=\"\/var\/log\/%HOSTNAME%\/%PROGRAMNAME%.log\")\n*.* ?RemoteLogs\n<\/code><\/pre>\n\n\n\n<p>4. <strong>Save and close<\/strong> the file, then <strong>restart rsyslog<\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart rsyslog<\/code><\/pre>\n\n\n\n<p>5. <strong>Allow Syslog Traffic through the Firewall<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open ports for UDP and TCP on port 514 (if using both):<\/li>\n<\/ul>\n\n\n\n<p><strong>For Ubuntu\/Debian<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw allow 514\/tcp\n\nsudo ufw allow 514\/udp<\/code><\/pre>\n\n\n\n<p><strong>For firewalld (Almalinux\/CentOS\/RHEL):<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo firewall-cmd --permanent --add-port=514\/tcp\nsudo firewall-cmd --permanent --add-port=514\/udp\nsudo firewall-cmd --reload<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Configure Syslog Clients to Send Logs to the Central Server<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Install rsyslog<\/strong> on each client (if it\u2019s not already installed):<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update &amp;&amp; sudo apt install -y rsyslog # For Debian\/Ubuntu\n\nsudo yum install -y rsyslog # For RHEL\/CentOS<\/code><\/pre>\n\n\n\n<p>2. <strong>Configure the client to send logs to the central server<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open the <code>rsyslog<\/code> configuration file:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vi \/etc\/rsyslog.conf<\/code><\/pre>\n\n\n\n<p>Add the following lines at the end of the file to forward logs to the central Syslog server (replace <code>&lt;server_ip&gt;<\/code> with your server\u2019s IP address):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>*.* @&lt;server_ip>:514    # For UDP\n\n*.* @@&lt;server_ip>:514   # For TCP<\/code><\/pre>\n\n\n\n<p>For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>*.* @192.168.1.10:514<\/code><\/pre>\n\n\n\n<p>3. <strong>Save and close<\/strong> the file, then <strong>restart rsyslog<\/strong> on the client:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart rsyslog<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Verify Centralized Logging<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Generate a Test Log Entry<\/strong> on the client:Run the following command on the client to generate a sample log entry:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>logger \"Test log entry from client\"<\/code><\/pre>\n\n\n\n<p>2. <strong>Check Logs on the Server<\/strong>:<\/p>\n\n\n\n<p>On the Syslog server, look in <code>\/var\/log\/<\/code> or in the directory you specified. For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tail -f \/var\/log\/syslog<\/code><\/pre>\n\n\n\n<p>Or, if you configured a custom directory:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ls \/var\/log\/&lt;client_hostname>\/\n\nsudo tail -f \/var\/log\/&lt;client_hostname>\/test.log\n<\/code><\/pre>\n\n\n\n<p>You should see the test log entry from the client.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Optional &#8211; Setting Up Log Rotation (Recommended)<\/h3>\n\n\n\n<p>To prevent the central log server from filling up with logs, set up log rotation.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Edit or create a log rotation file<\/strong> (for custom logs):<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/logrotate.d\/remote-logs<\/code><\/pre>\n\n\n\n<p>2. <strong>Add the following configuration<\/strong> for log rotation:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/log\/*\/*.log {\n    daily\n    missingok\n    rotate 7\n    compress\n    delaycompress\n    notifempty\n    create 0640 syslog adm\n    sharedscripts\n    postrotate\n        \/usr\/lib\/rsyslog\/rsyslog-rotate\n    endscript\n}<\/code><\/pre>\n\n\n\n<p>This configuration will rotate logs daily, keep seven days\u2019 worth of logs, and compress old logs to save space.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Author&#8217;s final word<\/h3>\n\n\n\n<p>You have successfully set up a centralized Syslog server to collect logs from multiple Linux clients. This setup can help streamline log management, enhance monitoring, and enable centralized log analysis for better insights into your systems\u2019 health and security.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Setting up Syslog for centralized logging allows you to collect and analyze logs from multiple servers in a single location, improving visibility and management of system events. Here\u2019s a guide on configuring a centralized Syslog server and client. What is Syslog? Syslog (System Logging Protocol) is a standard protocol for message logging in Unix and [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"_eb_attr":"","_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"doc_category":[1820,1824,1879,2128],"doc_tag":[],"class_list":["post-16581","docs","type-docs","status-publish","hentry","doc_category-cloud-servers-in-kenya","doc_category-dedicated-servers","doc_category-servers","doc_category-vps-servers"],"year_month":"2026-07","word_count":658,"total_views":0,"reactions":{"happy":0,"normal":0,"sad":0},"author_info":{"name":"Eugene","author_nicename":"eugene","author_url":"https:\/\/truehost.com\/support\/author\/eugene\/"},"doc_category_info":[{"term_name":"Cloud servers in Kenya","term_url":"https:\/\/truehost.com\/support\/docs-category\/cloud-servers-in-kenya\/"},{"term_name":"dedicated servers","term_url":"https:\/\/truehost.com\/support\/docs-category\/dedicated-servers\/"},{"term_name":"Servers","term_url":"https:\/\/truehost.com\/support\/docs-category\/servers\/"},{"term_name":"VPS-Servers","term_url":"https:\/\/truehost.com\/support\/docs-category\/vps-servers\/"}],"doc_tag_info":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Set Up Syslog for Centralized Logging -<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Set Up Syslog for Centralized Logging -\" \/>\n<meta property=\"og:description\" content=\"Setting up Syslog for centralized logging allows you to collect and analyze logs from multiple servers in a single location, improving visibility and management of system events. Here\u2019s a guide on configuring a centralized Syslog server and client. What is Syslog? Syslog (System Logging Protocol) is a standard protocol for message logging in Unix and [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/\" \/>\n<meta property=\"article:modified_time\" content=\"2024-11-02T09:49:23+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/knowledge-base\\\/how-to-set-up-syslog-for-centralized-logging\\\/\",\"url\":\"https:\\\/\\\/truehost.com\\\/support\\\/knowledge-base\\\/how-to-set-up-syslog-for-centralized-logging\\\/\",\"name\":\"How to Set Up Syslog for Centralized Logging -\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/#website\"},\"datePublished\":\"2024-11-02T09:48:46+00:00\",\"dateModified\":\"2024-11-02T09:49:23+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/knowledge-base\\\/how-to-set-up-syslog-for-centralized-logging\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/truehost.com\\\/support\\\/knowledge-base\\\/how-to-set-up-syslog-for-centralized-logging\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/knowledge-base\\\/how-to-set-up-syslog-for-centralized-logging\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/truehost.com\\\/support\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Set Up Syslog for Centralized Logging\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/#website\",\"url\":\"https:\\\/\\\/truehost.com\\\/support\\\/\",\"name\":\"\",\"description\":\"Help In a Click\",\"publisher\":{\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/truehost.com\\\/support\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/#organization\",\"name\":\"Truehost Kenya\",\"url\":\"https:\\\/\\\/truehost.com\\\/support\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/truehost.com\\\/support\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/cropped-image_2026-04-16_174808866.png\",\"contentUrl\":\"https:\\\/\\\/truehost.com\\\/support\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/cropped-image_2026-04-16_174808866.png\",\"width\":240,\"height\":48,\"caption\":\"Truehost Kenya\"},\"image\":{\"@id\":\"https:\\\/\\\/truehost.com\\\/support\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Set Up Syslog for Centralized Logging -","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/","og_locale":"en_US","og_type":"article","og_title":"How to Set Up Syslog for Centralized Logging -","og_description":"Setting up Syslog for centralized logging allows you to collect and analyze logs from multiple servers in a single location, improving visibility and management of system events. Here\u2019s a guide on configuring a centralized Syslog server and client. What is Syslog? Syslog (System Logging Protocol) is a standard protocol for message logging in Unix and [&hellip;]","og_url":"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/","article_modified_time":"2024-11-02T09:49:23+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/","url":"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/","name":"How to Set Up Syslog for Centralized Logging -","isPartOf":{"@id":"https:\/\/truehost.com\/support\/#website"},"datePublished":"2024-11-02T09:48:46+00:00","dateModified":"2024-11-02T09:49:23+00:00","breadcrumb":{"@id":"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/truehost.com\/support\/knowledge-base\/how-to-set-up-syslog-for-centralized-logging\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/truehost.com\/support\/"},{"@type":"ListItem","position":2,"name":"How to Set Up Syslog for Centralized Logging"}]},{"@type":"WebSite","@id":"https:\/\/truehost.com\/support\/#website","url":"https:\/\/truehost.com\/support\/","name":"","description":"Help In a Click","publisher":{"@id":"https:\/\/truehost.com\/support\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/truehost.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/truehost.com\/support\/#organization","name":"Truehost Kenya","url":"https:\/\/truehost.com\/support\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/truehost.com\/support\/#\/schema\/logo\/image\/","url":"https:\/\/truehost.com\/support\/wp-content\/uploads\/2026\/04\/cropped-image_2026-04-16_174808866.png","contentUrl":"https:\/\/truehost.com\/support\/wp-content\/uploads\/2026\/04\/cropped-image_2026-04-16_174808866.png","width":240,"height":48,"caption":"Truehost Kenya"},"image":{"@id":"https:\/\/truehost.com\/support\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/docs\/16581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/comments?post=16581"}],"version-history":[{"count":1,"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/docs\/16581\/revisions"}],"predecessor-version":[{"id":16582,"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/docs\/16581\/revisions\/16582"}],"wp:attachment":[{"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/media?parent=16581"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/doc_category?post=16581"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/truehost.com\/support\/wp-json\/wp\/v2\/doc_tag?post=16581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}