6

How can I make it so log file is stored both remotely and locally using rsyslog?

Improve this question

3 Answers 3

Reset to default
8

It looks like it's as simple as two lines in the config file:

*.* @loghost
*.* /var/log/messages

The rsyslog example configs have a few instances of teeing like this. The key one:

kern.* /var/adm/kernel
kern.crit @finlandia;RFC3164fmt
kern.crit /dev/console
kern.info;kern.!err /var/adm/kernel-info

The second statement directs all kernel messages of the priority crit and 
higher to the remote host finlandia.
[...]
The third rule directs these messages to the actual console, so the person 
who works on the machine will get them, too.
Improve this answer
5

Wouter de Bie had a good answer, but he showed the UDP method of sending logs. In order to send them over the more reliable (though not 100%) TCP use something like:

\*.* @@remote.server.ip
Improve this answer
3

Put the following line in your /etc/rsyslog.d/remote.conf:

*.* @remote.server.ip

This can easily be extended for only logging specific facilities and levels to the remote server.

Improve this answer
2
  • Won't this just send the logs to the remote server and not the local one?
    – Kyle Brandt
    Sep 15, 2010 at 15:52
  • 3
    By default the configuration in Ubuntu for rsyslogd is done in /etc/rsyslog.conf. Here, local logging is already configured. Adding extra files in your /etc/rsyslog.d causes to log to a remote (or local) location as well. The /etc/rsyslog.d directory allows you to extend your configuration (not override it).
    – Wouter de Bie
    Sep 15, 2010 at 17:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .