Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to chain syslog forwarding? For example, how can a clienthost forward its syslogs to ServerA and ServerA forward everything to CentralSyslogServer?

I'm using rsyslog.

The reason is that Server A is a dual homed machine which gets logs from other hosts which should all be stored in CentralSyslogServer. Currently CentralSyslogServer seems to only be getting ServerA's local logs but nothing that was forwarded to ServerA from the clienthost.

Resolved:

I had to edit /etc/sysconfig/syslog and add -h to the SYSLOGD_OPTIONS

My mistake - serverA is using syslogd

share|improve this question

3 Answers 3

up vote 1 down vote accepted

Yes you can:

In clienthost's rsyslog.conf:

*.* @@ServerA:514

In ServerA's rsyslog.conf:

*.* @@CentralSyslogServer:514

Of course, this is some really basic usage. Read the manual or online how-tos to get more advanced usage. Here's a little how-to about reliable forwarding with rsyslog.

To tell your servers to receive logs:

$ModLoad imtcp
$InputTCPServerRun 514
share|improve this answer
    
I've placed that rule in syslog.conf so it sends all facilities and levels to centralsyslogserver but it doesn't show up in centralsyslogserver strangely. –  garg Aug 24 '11 at 16:06
    
Well, as I said in my answer, this is really basic usage and you definitly need some more configuration. At the very least, you also need to tell your servers to receive logs. Updated my answer for this... –  skinp Aug 24 '11 at 16:14

It depends on the volume of syslogs you're getting but something like the free version of Splunk is just great at that kind of thing, not 100% sure it'll fit your requirement but thought I'd let you know anyway.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.