Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like
WWW server in DMZ ----> monitor server in LAN.

I can connect DMZ from my LAN

LAN --via proxy--> WWW server in DMZ.

I'm going to use syslog-ng. Problem is that syslog-ng work in client-server architecture and clients connect to server to send logs.

Is there a way to configure syslog-ng in some type passive mode that server (in my LAN) will connect to clients(DMZ) and collect logs?

EDIT: I was reading about Zabbix proxy (zabbix can monitor logs) ... And teoreticaly relying on zabbix docs it will be posible to make my scenario work. Anybody can confirm that?

share|improve this question
Is there any other host in the DMZ that can connect to monitor server? – quanta Dec 6 '11 at 9:58
no there isn't, LAN is not accessible from outside – B14D3 Dec 6 '11 at 10:21

What about tunneling, i.e. using Stunnel? For every DMZ server to be monitored:

  1. Let the logserver start a tunnel to the DMZ server
  2. Configure the DMZ server's syslog so that it connects to the tunnel and use it as additional destination

Note: this may work through firewall/NAT (as per your title) but not through proxy (as per your question content).

share|improve this answer

I don't know about syslog-ng, but I know that Splunk can be configured to collect and index log files from client systems periodically. Otherwise, the best I think you would be able to do is to setup a cron job on your log server to rsync the files to something like /var/log/clientN/*.log, and manually call logrotate on the client.

share|improve this answer
im looking for ready-made solution, i want avoid making logging system from scratch (rsync, email etc..) – B14D3 Dec 14 '11 at 8:40

This might not help, but I'll share how we get around this. Essentially we use multiple DMZs.

  • DMZ1 contains Internet-facing hosts and cannot talk back to the inside LAN.
  • DMZ2 is a segregated area (on the same firewall, different VLAN) that can talk to hosts in DMZ1 (both ways) but not the Internet. Some hosts in DMZ2 can also talk to certain hosts on the inside LAN.

Therefore hosts in DMZ1 that need to syslog centrally/scp files/send email reports do so via a management host in DMZ2. The information on the management host can then be picked up by a host on the inside.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.