Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking at building a syslog relay in order to move from my clients'-enforced UDP stream to TCP. Specifically, I would like to move from

client --UDP_PORT_999--> server1


client --UDP_PORT_999--> server1 --TCP_PORT_514--> server2

I found in the rssylog documentation both how to setup remote (client and server) syslog and how to correctly configure failover (in case where server2 is not available) but I do not know how to translate "forward to server2 only messages coming from a remote client" (or, alternatively, "forward to server2 only messages coming on port UDP 999"). In other words I would like to keep local syslog processing on server1 and simply proxy what comes in via UDP to outgoing messages via TCP.

I am not religiously attached to rsyslog so if there is a good way to set this up (including failover) on syslog-ng it would be perfect as well.

Thank you for any pointers!


PS. I posted the question on the rsyslog forum just to realize afterwards that I will be probably better off posting my question here :)

EDIT: nxlog will be a better solution (see answer below & my comment)

share|improve this question
up vote 2 down vote accepted

I can also recommend you nxlog as its configuration allows you to more naturally define the flow what you specified above.

Config skeleton:

<Input udpin>
 Module im_udp

<Output tcpout>
 Module om_tcp

<Route forwarder>
 Path udpin => tcpout
share|improve this answer
I happened to discover nxlog yesterday and it exactly fullfils my needs, and does it better than rsyslog. It uses buffering in a very natural way and, as you mentionned, has a natural and simple configuration. I am switching to it for general logging soon. – WoJ Jan 11 '12 at 7:40

I found a reasonable way to achieve this by adding the following config line to /etc/rsyslog.conf on server1:

:fromhost-ip, !isequal, "" @@server2

(rsyslog documentation states that $fromhost-ip=127.0.01 for local messages)

The configuration works, as tested with the excellent remote-syslog.

share|improve this answer
rsyslog can read local log file by itself using the imfile input module. See – Philippe Mar 15 '13 at 20:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.