Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

How can I make it so log file is stored both remotely and locally using rsyslog?

share|improve this question

3 Answers

up vote 3 down vote accepted

It looks like it's as simple as two lines in the config file:

*.* @loghost
*.* /var/log/messages

The rsyslog example configs have a few instances of teeing like this. The key one:

kern.* /var/adm/kernel
kern.crit @finlandia;RFC3164fmt
kern.crit /dev/console
kern.info;kern.!err /var/adm/kernel-info

The second statement directs all kernel messages of the priority crit and 
higher to the remote host finlandia.
[...]
The third rule directs these messages to the actual console, so the person 
who works on the machine will get them, too.
share|improve this answer
up vote 3 down vote

Put the following line in your /etc/rsyslog.d/remote.conf:

*.* @remote.server.ip

This can easily be extended for only logging specific facilities and levels to the remote server.

share|improve this answer
Won't this just send the logs to the remote server and not the local one? – Kyle Brandt♦ Sep 15 '10 at 15:52
2  
By default the configuration in Ubuntu for rsyslogd is done in /etc/rsyslog.conf. Here, local logging is already configured. Adding extra files in your /etc/rsyslog.d causes to log to a remote (or local) location as well. The /etc/rsyslog.d directory allows you to extend your configuration (not override it). – Wouter de Bie Sep 15 '10 at 17:26
up vote 3 down vote

Wouter de Bie had a good answer, but he showed the UDP method of sending logs. In order to send them over the more reliable (though not 100%) TCP use something like:

*.* @@remote.server.ip

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.