Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet.

I've tried syslog-ng but can't make it work in a secure way, a normal ssh -L PORT:localhost:PORT user@host SSH tunnel won't work because I believe that makes the logs appear to come from the local machine, and a VPN seems a bit like overkill.

share|improve this question
up vote 18 down vote accepted

Have you tried syslog-ng and stunnel?

  1. Install Stunnel
  2. Create certificate files for syslog-ng over Stunnel
  3. Configure Stunnel for Use With syslog-ng
  4. Install syslog-ng
  5. Configure syslog-ng
  6. DONE!


Stunnel ( is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix and Windows. Stunnel can allow you to secure non-SSL aware daemons and protocols (like POP, IMAP, LDAP, etc) by having Stunnel provide the encryption, requiring no changes to the daemon's code.

share|improve this answer
This is what we use to send syslog from our DMZ to our internal network. Works well. – Kamil Kisiel Jun 5 '09 at 22:46
For what it's worth, syslog-ng 3.x supports TLS natively, so, no need to use stunnel anymore. – synthesizer Feb 6 '12 at 7:28

Short answer: VPN

It may seem overkill, but it is the right answer and not that complicated to set up.

share|improve this answer
right!; is really simple to set up and just works. – pQd Jun 5 '09 at 20:56
Not only that, but it also gives you a lot more flexibility to manage and monitor the remote machines securely. OpenVPN (or even IPSec) will be much better in the long run. – Christopher Cashell Jun 12 '09 at 19:28

Rsyslog can do this. Encrypting Syslog Traffic with TLS

share|improve this answer
Aren't you still opening a port to the internet with this solution? I'd still be loathe to do that for something like this. – Kevin Kuphal Jun 5 '09 at 21:17
Kevin: It's assumed that your syslog server would be expecting traffic from certain predetermined IPs, which is easy to accomplish via iptables – Matt Simmons Jun 5 '09 at 21:58
Most cloud providers also allow flexible security groups which allow you to whitelist specific ports from specific IPs. – jorfus Mar 26 at 0:15

You might also check out the free Kiwi Secure Tunnel

share|improve this answer

Use syslog-ng or another syslog daemon that supports TCP.

Send the data over an encrypted tunnel. Don't use an ssh tunnel, it is too fiddly.

UDP syslog is a historical braindamaged protocol that should have been eliminated long ago. If your vendor provides it by default, please lean on them.

If your vendor does not provide a syslog solution that signs each message before sending it on, lean on them.

The software is easy, the algorithms are easy. The politics of getting it installed by default are not.

share|improve this answer
UDP syslog has certain advantages when it comes not causing outages if the destination goes down for longer periods. Not a too big deal with syslog-ng, but can be a nightmare in rsyslog. Encryption's value is nothing I want to question by saying that. – Florian Heigl Mar 25 at 19:21

I probably wouldn't send log data over the internet in the first place, but install a centralized loghost at the location(s) where needed.

These days, I prefer rsyslog to syslog-ng. It is a near drop in replacement, and has a variety of papers and howtos, including one on sending encrypted data with TLS/SSL (as of v3.19.0), older versions can still use stunnel.

In my experience with both rsyslog and syslog-ng, rsyslog wins out in ease of configurability, especially since you can use your existing syslog.conf, and add onto that.

For what it's worth, Rsyslog is the default syslog daemon on Debian Lenny (5.0), Ubuntu and Fedora.

share|improve this answer
It's just too bad that rsyslog hasn't yet added the new (planned) config file syntax. Right now, configuring rsyslog for anything non-trivial is painful compared to syslog-ng. – Christopher Cashell Jun 12 '09 at 19:29

I'm using rsyslog with tls. There is some out of scope prep work: Deploy a local CA, add the CA's cert to each host, generate individual certs for each host. (now all of your hosts can talk ssl to each other)

I also needed to install rsyslog-gnutls:

sudo apt-get install rsyslog-gnutls

I have also restricted the outgoing syslog connection (tcp 514) so my hosts can only connect to my rsyslog server, and created an incoming whitelist on the rsyslog server side so only my hosts can connect.

in /etc/rsyslog.conf

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /etc/my_keys/internal_CA.crt
$DefaultNetstreamDriverCertFile /etc/my_keys/my_hostname.crt
$DefaultNetstreamDriverKeyFile /etc/my_keys/my_hostname.key

$ActionSendStreamDriverAuthMode x509/name
$ActionSendStreamDriverMode 1 # run driver in TLS-only mode
*.* # forward everything to remote server

It looks like the config for syslog-ng is even easier. (though I haven't tried this) syslog-ng /etc/syslog-ng/conf.d/99-graylog2.conf

destination remote-server {  
    tcp ("" port(514)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.