Setup Central Logging Server on HA mode with Rsyslog in Linux

Centralized Logging System
  • Active Server: 10.194.168.128 ; Hostname: syslog-server-1
  • Passive Server: 10.194.168.129 ; Hostname: syslog-server-2
  • Client1 : 10.194.168.163 ; Hostname: syslog-server-3
  • Client2 : 10.194.168.164 ; Hostname: syslog-server-4
$ sudo vim /etc/rsyslog.conf
$ModLoad imtcp
$InputTCPServerRun 514
module(load="imtcp")
input(type="imtcp" port="514")
$template RemoteLogs,"/var/syslog/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?RemoteLogs
$ sudo systemctl restart rsyslog
$ sudo ss -tulnp | grep "rsyslog"

Step 2: Configure Rsyslog Client to Send Logs to Rsyslog Server

If it’s not installed, install it and start the service as shown earlier on.

$ sudo yum update && yum install rsyslog 	#CentOS 7
$ sudo apt update && apt install rsyslog #Ubuntu 16.04, 18.04
$ sudo systemctl start rsyslog
$ sudo systemctl enable rsyslog
$ sudo systemctl status rsyslog
$ sudo vim /etc/rsyslog.conf
##Enable sending of logs over TCP add the following line:
*.* @@10.194.168.128:514
#Failover rsyslog server details (HA Mode)
$ActionExecOnlyWhenPreviousIsSuspended on
& @@10.194.168.129:514
$ActionExecOnlyWhenPreviousIsSuspended off
#########################################
##Set disk queue when rsyslog server will be down:
$ActionQueueFileName queue
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
# END ANSIBLE MANAGED BLOCK
auth. *  @@10.194.168.128:514
$ sudo systemctl restart rsyslog

Step 3: Monitor Remote Logging on the Rsyslog Server

Run a ls command in syslog server to long listing of the parent logs directory and check if there is a directory called ip-10.194.168.163 (or whatever your client machine’s hostname is).

$ ls -l /var/syslog/
Output of ls -l /var/syslog/

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store