I've managed to successfully switch from syslogd to syslog-ng for my logging. I would however like to have the syslog-ng box receiving all logs from the all boxes running syslog on the network. How do I go about this?
Well, for syslogd it should be straight forward. On each client, add this line to syslog.conf:
This is the way I do it, and I make the syslog-ng host sort and/or throw away there.
Keep in mind that this sends everything -- including login success/failures -- over the wire. This may not be what you want.
Remember that syslog.conf likes tabs, not spaces.
With syslog-ng, you want to add a destination to /etc/syslog-ng/syslog-ng.conf
You then need a log rule. Something along the lines of this should work.
You'll probably need to change s_all to whatever is defined in your syslog-ng.conf as the general source for logs. You'll then need to add a line like this to your standard log source on your log collecter.