Centralized syslog-ng logging on FreeBSD

Question

I've managed to successfully switch from syslogd to syslog-ng for my logging. I would however like to have the syslog-ng box receiving all logs from the all boxes running syslog on the network. How do I go about this?

Answer 1

Well, for syslogd it should be straight forward. On each client, add this line to syslog.conf:

*.debug             @syslogng-host

This is the way I do it, and I make the syslog-ng host sort and/or throw away there.

Keep in mind that this sends everything -- including login success/failures -- over the wire. This may not be what you want.

Remember that syslog.conf likes tabs, not spaces.

Answer 2

With syslog-ng, you want to add a destination to /etc/syslog-ng/syslog-ng.conf

destination loghost {
    tcp("your.hostname.goes.here" port(514));
};

You then need a log rule. Something along the lines of this should work.

log{
    source(s_all);
    destination(loghost);
};

You'll probably need to change s_all to whatever is defined in your syslog-ng.conf as the general source for logs. You'll then need to add a line like this to your standard log source on your log collecter.

tcp();