Use a Mac (10.8) as a remote log server

Question

I'm trying to use my Mac Mini server as a remote log server for our router. I set the router to forward the logs to the server but I'm not seeing the logs anywhere in the console app.

Am I missing something?

Thanks a lot in advance.

Answer 1

You have to configure the OS X (or any other OS) to accept remote syslogs using something like syslogd. This article has a very basic tutorial on this.

Simply pointing a device's syslog application to a remote machine isn't enough, if it were malicious users would be able to make a system run full disk with little effort.

Answer 2

Unfortunately, the article @MDMarra linked is somewhat out of date -- in OS X 10.7, Apple switched the syslogd LaunchDaemon to binary plist format, meaning that it isn't just a matter of editing it with a text editor. Here's how to add the network listener with PlistBuddy:

cd /System/Library/LaunchDaemons
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener dict" com.apple.syslogd.plist
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockServiceName string syslog" com.apple.syslogd.plist
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockType string dgram" com.apple.syslogd.plist
sudo launchctl unload com.apple.syslogd.plist
sudo launchctl load com.apple.syslogd.plist

Note: I haven't fully tested this; it listens for UDP on the right socket, but I haven't verified that it still handles incoming packets properly.