Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've managed to successfully switch from syslogd to syslog-ng for my logging. I would however like to have the syslog-ng box receiving all logs from the all boxes running syslog on the network. How do I go about this?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Well, for syslogd it should be straight forward. On each client, add this line to syslog.conf:

*.debug             @syslogng-host

This is the way I do it, and I make the syslog-ng host sort and/or throw away there.

Keep in mind that this sends everything -- including login success/failures -- over the wire. This may not be what you want.

Remember that syslog.conf likes tabs, not spaces.

share|improve this answer
add comment

With syslog-ng, you want to add a destination to /etc/syslog-ng/syslog-ng.conf

destination loghost {
    tcp("your.hostname.goes.here" port(514));
};

You then need a log rule. Something along the lines of this should work.

log{
    source(s_all);
    destination(loghost);
};

You'll probably need to change s_all to whatever is defined in your syslog-ng.conf as the general source for logs. You'll then need to add a line like this to your standard log source on your log collecter.

tcp();
share|improve this answer
    
I'd vote up if I could but my rep is till low...thnx Cian. –  Stephen M Sep 21 '09 at 7:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.