Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've managed to successfully switch from syslogd to syslog-ng for my logging. I would however like to have the syslog-ng box receiving all logs from the all boxes running syslog on the network. How do I go about this?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Well, for syslogd it should be straight forward. On each client, add this line to syslog.conf:

*.debug             @syslogng-host

This is the way I do it, and I make the syslog-ng host sort and/or throw away there.

Keep in mind that this sends everything -- including login success/failures -- over the wire. This may not be what you want.

Remember that syslog.conf likes tabs, not spaces.

share|improve this answer

With syslog-ng, you want to add a destination to /etc/syslog-ng/syslog-ng.conf

destination loghost {
    tcp("your.hostname.goes.here" port(514));
};

You then need a log rule. Something along the lines of this should work.

log{
    source(s_all);
    destination(loghost);
};

You'll probably need to change s_all to whatever is defined in your syslog-ng.conf as the general source for logs. You'll then need to add a line like this to your standard log source on your log collecter.

tcp();
share|improve this answer
    
I'd vote up if I could but my rep is till low...thnx Cian. –  Stephen M Sep 21 '09 at 7:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.