---
title: "How to Create a Centralized Logging Rsyslog Configuration"
description: "Learn how to set up a centralized logging Rsyslog configuration to analyze logs data from different remote machines in this step-by-step tutorial!"
canonical: "https://adamtheautomator.com/rsyslog-configuration/"
---

# How to Create a Centralized Logging Rsyslog Configuration

> Learn how to set up a centralized logging Rsyslog configuration to analyze logs data from different remote machines in this step-by-step tutorial!

Source: https://adamtheautomator.com/rsyslog-configuration/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![How to Create a Centralized Logging Rsyslog Configuration](https://adamtheautomator.com/wp-content/uploads/2022/03/How-to-Create-a-Centralized-Logging-Rsyslog-Configuration.jpg)

# How to Create a Centralized Logging Rsyslog Configuration

[![](https://secure.gravatar.com/avatar/572a248f516b6d0cd566cb44fdbd9336f30ef95aa0f6d78f118c1f47b1b6d6b7?s=192&d=mm&r=g)Arvid Larson](https://adamtheautomator.com/author/arvid-larson/)4 March 202210 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[Linux](/tag/linux/)[Logging](/tag/logging/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [Checking Rsyslog Service on All Servers](#checking-rsyslog-service-on-all-servers)
*   [Configuring Rsyslog for Centralized Logging](#configuring-rsyslog-for-centralized-logging)
*   [Sending Logs to Centralized Rsyslog Server](#sending-logs-to-centralized-rsyslog-server)
*   [Sending Logs of Specific Program to Rsyslog Server](#sending-logs-of-specific-program-to-rsyslog-server)
*   [Sending Syslog Message-Converted Logs to Rsyslog Server](#sending-syslog-message-converted-logs-to-rsyslog-server)
*   [Conclusion](#conclusion)

Logs are a critical part of applications and server infrastructure but analyzing them can be a pain if they are cluttered everywhere. Why not create a centralized logging system? Rsyslog may just be what you’re looking for!

A centralized logging system allows you to collect logs from multiple servers/applications to the central log server. And in this tutorial, you’ll learn how to set up centralized logging using the Rsyslog configuration on Linux servers.

Get ready and jump right in!

## Prerequisites

This tutorial will be a hands-on demonstration. If you’d like to follow along, ensure you have the following:

*   Two or more Linux servers – This tutorial uses three [Debian 11](https://www.debian.org/download) servers named _central-rsyslog_, _client01_, and _client02_.

Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/)

*   A user with [sudo/root](https://www.digitalocean.com/community/tutorials/how-to-create-a-sudo-user-on-ubuntu-quickstart) privileges on all servers.

## Checking Rsyslog Service on All Servers

Rsyslog is a high-performance log processing for Linux distribution, installed by default on Debian-based and RHEL-based distributions.

Rsyslog is a reliable and extended version of the [Syslog protocol](https://geek-university.com/syslog-protocol-explained/) with additional modern features. These additional features are multiple inputs and outputs, modular, and rich filtering capabilities.

At the time of this writing, the latest version of Rsyslog is v8.2112.0. So you’ll be checking the installed version of Rsyslog on your system and the status of the Rsyslog service. Doing so ensures that you get the latest features of Rsyslog and that Rsyslog is running without problem.

1\. Open your terminal, log in to all servers, and run the [`sudo su`](https://linuxize.com/post/su-command-in-linux/) command below to get the root privileges. Enter the password for your user when prompted.

```bash
sudo su
```

2\. Next, run the [`rsyslogd`](https://man7.org/linux/man-pages/man8/rsyslogd.8.html) command to check the Rsyslog version installed on your system.

Ensure that you have the Rsyslog v8.xxx on your system because some configurations are only available on Rsyslog v8.xxx.

```bash
# checking rsyslog version
rsyslogd -v
```

As you see below, The Debian 11 system comes with default Rsyslog v8.2102.0.

![Checking Rsyslog version](https://adamtheautomator.com/wp-content/uploads/2022/03/image-18.png)

Checking Rsyslog version

3\. Lastly, run the `systemctl` command below to verify the Rsyslog service. Make sure the Rsyslog service is `active (running)`.

```bash
# verify rsyslog service status
sudo systemctl status rsyslog
```

As you can see below, the [Rsyslog](https://adamtheautomator.com/ubuntu-systemctl/) service is active (running).

![Checking if Rsyslog Service is Running](https://adamtheautomator.com/wp-content/uploads/2022/03/image-19.png)

Checking if Rsyslog Service is Running

Related:[Controlling Systemd services with Ubuntu systemctl](https://adamtheautomator.com/ubuntu-systemctl/)

## Configuring Rsyslog for Centralized Logging

Now that you have the latest version of Rsyslog running, it’s time to set up centralized logging using the Rsyslog configuration on the _central-rsyslog_ server.

To set up centralized logging, you’ll enable the Rsyslog UDP input module [`imudp`](https://www.rsyslog.com/doc/v8-stable/configuration/modules/imudp.html) and create the Rsyslog template for receiving log messages from other servers. The `imudp` input module provides the ability for the _central-rsyslog_ server to receive Syslog messages through the UDP protocol.

1\. Edit the Rsyslog configuration file (_/etc/rsyslog.conf_) using your preferred editor and enable the configuration shown image below, then save the changes and exit the editor.

> _Throughout this tutorial, uncomment each configuration to enable them by removing the # sign at the beginning of each line._

This configuration enables the imudp input module to run on default UDP port 514.

![Enabling Rsyslog imudp input module](https://adamtheautomator.com/wp-content/uploads/2022/03/image-20.png)

Enabling Rsyslog imudp input module

2\. Next, create a new Rsyslog template (_/etc/rsyslog.d/50-remote-logs.conf_) using your preferred editor and populate the template with the configuration below. Save the changes and exit the editor.

This Rsyslog template below enables the _central-rsyslog_ server to store logs from remote servers to the /var/log/remotelogs/ directory .

```powershell
# define template for remote loggin
# remote logs will be stored at /var/log/remotelogs directory
# each host will have specific directory based on the system %HOSTNAME%
# name of the log file is %PROGRAMNAME%.log such as sshd.log, su.log
# both %HOSTNAME% and %PROGRAMNAME% is the Rsyslog message properties
template (
    name="RemoteLogs"
    type="string"
    string="/var/log/remotelogs/%HOSTNAME%/%PROGRAMNAME%.log"
)

# gather all log messages from all facilities
# at all severity levels to the RemoteLogs template
*.* -?RemoteLogs

# stop the process once the file is written
stop
```

3\. Run the commands below to create a new log directory (`/var/log/remotelogs/`) owned by the `root` user with `adm` group. Doing so allows the Ryslog service to write logs to the `/var/log/remotelogs` directory.

```bash
# create /var/log/remotelogs/ directory
mkdir -p /var/log/remotelogs/

# change the ownership to root:adm
sudo chown -R root:adm /var/log/remotelogs/
```

4\. Now, run the [`rsyslogd`](https://www.thegeekdiary.com/rsyslogd-command-examples-in-linux/) commands below to verify the Rsyslog configurations (`/etc/rsyslog.conf` and `/etc/rsyslog.d/50-remote-logs.conf`).

> _Be sure to always check and verify the Rsyslog configuration after editing the Rsyslog configuration to ensure the configuration has no error._

```bash
# verify /etc/rsyslog.conf
rsyslogd -N1 -f /etc/rsyslog.conf

# verify /etc/rsyslog.d/50-remote-logs.conf
rsyslogd -N1 -f /etc/rsyslog.d/50-remote-logs.conf
```

If there’s no error, you’ll get the output like the one below.

![Checking and Verifying Rsyslog Configurations](https://adamtheautomator.com/wp-content/uploads/2022/03/image-21.png)

Checking and Verifying Rsyslog Configurations

5\. After verifying the configurations, run the below command to `restart` the `rsyslog` service and apply new configurations.

The Rsyslog service is already running with the imudp input module enabled and opened the default UDP port 514 for the Syslog protocol. The _central-rsyslog_ server is now ready to receive log messages from other hosts.

```bash
# restart rsyslog
sudo systemctl restart rsyslog
```

6\. Lastly, run the `ss` command below to verify the opened ports on your system.

```bash
# check open ports
ss -plntu
```

Below, you can see that the Rsyslog service with imudp input module enabled is running on default UDP port 514.

![Verifying Rsyslog Service Runs on UDP Port 514](https://adamtheautomator.com/wp-content/uploads/2022/03/image-22.png)

Verifying Rsyslog Service Runs on UDP Port 514

## Sending Logs to Centralized Rsyslog Server

By now, you’ve configured centralized log management with Rsyslog configuration in the _central-rsyslog_ server. But how do you know the _central-rsyslog_ server receives logs? You’ll send logs remotely to the centralized Rsyslog server (_central-rsyslog_) by enabling and configuring the Rsyslog output module on the client machine.

In this demo, the client machine (with the hostname _client01)_ uses the Rsyslog output module [`omfwd`](https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html) to send logs to the _central-rsyslog_ server.

The `omfwd` module is a built-in module that processes messages/logs through Rsyslog templates. The module then transfers the messages to various targets via UDP and TCP using the Rsyslog [action object](https://www.rsyslog.com/doc/master/configuration/actions.html).

1\. Move to the _client01_ machine to set up and send logs to the _central-rsyslog_ server.

2\. Create new Rsyslog configuration (_/etc/rsyslog.d/20-forward-logs.conf_) using your preferred editor and populate the following configuration.

This configuration formats log messages using the SendRemote template and forwards log messages via UDP protocol to the target _central-rsyslog_ server (172.16.1.10). Make sure to change the IP address with your central Rsyslog server’s IP address.

> _An Rsyslog template is constructs of [Rsyslog message properties](https://www.rsyslog.com/doc/master/configuration/properties.html) that specify formats of log messages. Check the documentation of the [Rsyslog template](https://www.rsyslog.com/doc/master/configuration/templates.html) to see different types of templates._

```powershell
# process all log messages before sending
# with the SendRemote template
template(
    name="SendRemote"
    type="string"
    string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
)

# forward log messages using omfwd module
# to the target server 172.16.1.10
# via UDP porotocol on port 514
# log messages is formatted using the SendRemote template
# setup queue for remote log
action(
    type="omfwd"
    Target="172.16.1.10"
    Port="514"
    Protocol="udp"
    template="SendRemote"

    queue.SpoolDirectory="/var/spool/rsyslog"
    queue.FileName="remote"
    queue.MaxDiskSpace="1g"
    queue.SaveOnShutdown="on"
    queue.Type="LinkedList"
    ResendLastMSGOnReconnect="on"
)

# stop process after the file is written
stop
```

3\. Next, run the below `rsyslogd` command to verify the Rsyslog configuration and ensure there is no error.

```bash
# verify rsyslog configuration
rsyslogd -N1 -f /etc/rsyslog.d/20-remote-logs.conf
```

![Verifying Rsyslog Configuration](https://adamtheautomator.com/wp-content/uploads/2022/03/image-23.png)

Verifying Rsyslog Configuration

4\. Run the `systemctl` command below to restart the Rsyslog service and apply a new configuration.

```bash
# restart rsyslog on client01 machine
sudo systemctl restart rsyslog
```

5\. Now, move back to the _central-rsyslog_ server to verify logs from the _client01_ machine.

Run the below commands to navigate to the /var/log/remotelogs directory and list the files and directories inside that directory to verify the _client01_ directory exists.

```bash
# navigate to /var/log/remotelogs directory
cd /var/log/remotelogs/
# checking available directories
ls -lah
```

Below, you can see the client01 directory exists in the _/var/log/remotelogs_ directory.

![Verifying client01 Directory Exists](https://adamtheautomator.com/wp-content/uploads/2022/03/image-24.png)

Verifying _client01_ Directory Exists

6\. Run each command below to switch to the `client01` directory and list (`ls -lah`) the log files inside the directory.

```bash
# navigate to client01 directory
cd client01/
# checking files inside client01 directory
ls -lah
```

> _A centralized logging system helps administrators analyze logs data from hundreds of servers in a single machine._

Choose one of the logs you want to view and analyze.

![Listing Log Files inside the client01 Directory](https://adamtheautomator.com/wp-content/uploads/2022/03/image-25.png)

Listing Log Files inside the _client01_ Directory

7\. Lastly, run the `cat` command below to see your target log’s content. Replace `logfile` with the log file’s name, but this demo returns the content of the _sshd.log_ file.

```bash
cat logfile
```

Below, you can see logs from the _client01_ machine stored in the _sshd.log_ file in the Rsyslog server (_central-rsyslog_).

![Verifying Logs from client01 machine on the Rsyslog Server](https://adamtheautomator.com/wp-content/uploads/2022/03/image-26.png)

Verifying Logs from _client01_ machine on the Rsyslog Server

> _So far, you’ve seen that a centralized logging system makes log files safer because whenever applications/servers are terminated, you still have the log files on the central server._

## Sending Logs of Specific Program to Rsyslog Server

You’ve just sent all application logs from the _client01_ machine to the central Rsyslog server (_central-rsyslog_). But what if you only need specific application logs, such as `ssh` or `su`? Implement the Rsyslog [rainerscript](https://www.rsyslog.com/doc/master/rainerscript/index.html) control structure on the Rsyslog action object.

This demo uses the _client02_ machine to send sshd logs only to the Rsyslog server (_central-rsyslog_).

1\. Move to the _client02_ machine to set up and send logs to the _central-rsyslog_ server.

2\. Create a new Rsyslog configuration (`/etc/rsyslog.d/50-sshd.conf`) using your preferred editor and populate the following configuration.

This configuration below only forwards logs for the application (programname) named sshd to the Rsyslog server (172.16.1.10). The log messages are also formatted by the SendRemote template.

```powershell
# create new Rsyslog tempate for formatted logs
template(
    name="SendRemote"
    type="string"
    string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
)

# implementation of if conditional on rsyslog
# to send specific logs for programname sshd
# stop the process after sending logs
if $programname == "sshd" then {
        action(type="omfwd" target="172.16.1.10" port="514" protocol="udp" template="SendRemote")
        stop
}
```

3\. Next, run the `rsyslogd` command below to verify the Rsyslog configuration and ensure there is no error.

```bash
# verify rsyslog configuration
rsyslogd -N1 -f /etc/rsyslog.d/50-sshd.conf
```

![Verifying Rsyslog Configuration](https://adamtheautomator.com/wp-content/uploads/2022/03/image-27.png)

Verifying Rsyslog Configuration

4\. Run the below command to restart the Rsyslog service, apply a new configuration, and log out from the `client02` server to generate a new `sshd` log.

At this point, the central-rsyslog server has only received the sshd log instead of all system logs.

```bash
# restart rsyslog service
sudo systemctl restart rsyslog
```

5\. Now, move back to the _central-rsyslog_ server to verify logs from the _client02_ machine.

Run the below commands to list (ls -lah) available log files in the /var/log/remotelogs/ directory.

```bash
# navigate to /var/log/remotelogs/
cd /var/log/remotelogs/
# verify log directory for client02
ls -lah
```

As you see below, there’s a new directory named client02 that stores log messages from the _client02_ machine.

![Listing Available Log Files in the /var/log/remotelogs/ Directory](https://adamtheautomator.com/wp-content/uploads/2022/03/image-28.png)

Listing Available Log Files in the _/var/log/remotelogs/_ Directory

6\. Run the below commands to navigate to the `client02` directory and verify the available log files on that directory.

```bash
cd client02/
ls -lah
```

You will see the log file sshd.log for the programname sshd. Also, run the cat command to show the content of the log file sshd.log.

Below, you can see only one log file available, the sshd.log file, since you used the /etc/rsyslog.d/50-sshd.conf configuration.

![Verifying only sshd log is Received from the client02 Machine on the Rsyslog server](https://adamtheautomator.com/wp-content/uploads/2022/03/image-29.png)

Verifying only sshd log is Received from the client02 Machine on the Rsyslog server

7\. Finally, run the `cat` command below to view and analyze the `sshd.log` file.

```bash
cat sshd.log
```

![Viewing sshd.log File’s Content](https://adamtheautomator.com/wp-content/uploads/2022/03/image-30-1024x106.png)

Viewing _sshd.log_ File’s Content

## Sending Syslog Message-Converted Logs to Rsyslog Server

So far, you’ve seen how to send logs to your Rsyslog server, and that’s good enough. But perhaps you prefer to have your logs in Syslog message format to make them easier to read and analyze. If so, using the Rsys [`imfile`](https://www.rsyslog.com/doc/master/configuration/modules/imfile.html) input module will do the trick.

The `imfile` input module allows you to convert any text messages/logs into a Syslog message format. And in this demo, you’ll send logs of the Apache2 web server from the _client01_ machine to the Rsyslog server (_central-rsyslog_).

Combining the Rsyslog input module (`imfile`) with the output module (`omfwd`) allows you to send any Syslog message-converted logs to the Rsyslog server (_central-rsyslog_).

1\. Move back to the _client01_ machine, create a new Rsyslog configuration `/etc/rsyslog.d/50-apache2.conf`, and populate the following configuration. Be sure to change the template name, ruleset name, and the input file for your logs.

The template below converts Apache logs to Syslog message format with the imfile module and sends those logs to the Rsyslog server (172.16.1.10).

```powershell
# deifne global workDirectory for saving the state file of log messages.
global(workDirectory="/var/spool/rsyslog")

# enable the Rsyslog imfile module processing text files or logs.
module(load="imfile" PollingInterval="10")

# define template for apache2 for processing log messages.
# that will be forwarded to rsyslog server
template(
    name="TestLog"
    type="string"
    string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
    )

# define ruleset "ApacheLogs" with action object to send logs to rsyslog server
# define the queue
ruleset(name="ApacheLogs") {
    action(
        type="omfwd"
        target="172.16.1.10"
        port="514"
        protocol="udp"
        template="TestLog"

        queue.SpoolDirectory="/var/spool/rsyslog"
        queue.FileName="remote"
        queue.MaxDiskSpace="1g"
        queue.SaveOnShutdown="on"
        queue.Type="LinkedList"
        ResendLastMSGOnReconnect="on"
        )
        stop
}

# define input files Apache2 logs to send to the Rsyslog server
# and apply ruleset "ApacheLogs"
input(type="imfile" ruleset="ApacheLogs" Tag="apache2" File="/var/log/apache2/*.log")
```

2\. Next, run the `rsyslogd` command below to verify the `/etc/rsyslog.d/50-apache2.conf` configuration.

```bash
# verify rsyslog configuration
rsyslogd -N1 -f /etc/rsyslog.d/50-apache2.conf
```

![Verifying Rsyslog configuration](https://adamtheautomator.com/wp-content/uploads/2022/03/image-31.png)

Verifying Rsyslog configuration

3\. Run the `systemctl` command below to `restart` the `rsyslog` service and apply new configurations. At this point, all Apache2 logs on the _client01_ machine will be forwarded to the Rsyslog server (_central-rsyslog_).

```bash
# restart rsyslog service
sudo systemctl restart rsyslog
```

4\. Now, run the `curl` command below to generate the Apache2 logs. This command will generate new Apache2 log messages to the file `/var/log/apache2/access.log`.

```bash
# generate a new log for Apache
# by accessing via curl command
curl localhost
curl localhost/testnotfound
```

5\. Move back to the Rsyslog server (_central-rsyslog_), and run the below commands to navigate to the `/var/log/remotelogs/client01` directory list available log files.

```bash
# navigate to the directory /var/log/remotelogs/client01/
cd /var/log/remotelogs/client01/
# check available log files
ls -a
```

You can see below that the Rsyslog server (_central-rsyslog_) received the apache.log file from the _client01_ machine.

![Listing Available Logs Received from the client01 Machine](https://adamtheautomator.com/wp-content/uploads/2022/03/image-32.png)

Listing Available Logs Received from the _client01_ Machine

6\. Lastly, run the `cat` command to show the content of the log file `apache2.log`.

```bash
# showing the content of apache2.log file
cat apache2.log
```

If the _/etc/rsyslog.d/50-apache2.conf_ works, you’ll see the content of the log file in Syslog message format like the one below.

![Viewing Syslog Message-converted Logs Received from the client01 Machine](https://adamtheautomator.com/wp-content/uploads/2022/03/image-33.png)

Viewing Syslog Message-converted Logs Received from the client01 Machine

## Conclusion

In this tutorial, you’ve learned how to set up centralized logging with Rsyslog configuration. You’ve also sent servers logs remotely to the centralized Rsyslog server using different types of Rsyslog input and output plugins. Now you don’t have to scour different places for logs anymore other than your Rsyslog server.

How else do you plan to use Rsyslog? Perhaps start exploring other Rsyslog [input](https://www.rsyslog.com/doc/master/configuration/modules/idx_input.html) and [output](https://www.rsyslog.com/doc/master/configuration/modules/idx_output.html) modules? Or integrate Rsyslog to another logging system, such as [Fluentd](https://docs.fluentd.org/input/syslog) and [Logstash](https://www.elastic.co/blog/how-to-centralize-logs-with-rsyslog-logstash-and-elasticsearch-on-ubuntu-14-04)?

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Frsyslog-configuration%2F&text=How%20to%20Create%20a%20Centralized%20Logging%20Rsyslog%20Configuration)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Frsyslog-configuration%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Frsyslog-configuration%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2022/03/How-to-Install-Sysdig-to-Monitor-Your-Linux-System.jpg)

### [How to Install Sysdig to Monitor Your Linux System](/sysdig/)

Learn many ways to monitor how your Linux system behaves by installing Sysdig and running commands in your terminal in this step-by-step tutorial!

![](https://adamtheautomator.com/wp-content/uploads/2022/02/Network-Troubleshooting-from-the-Command-Line-with-TShark.jpg)

### [Network Troubleshooting from the Command-Line with TShark](/tshark/)

Learn how to set up TShark on your machine to capture packets for effective network troubleshooting in this step-by-step tutorial!

![](https://adamtheautomator.com/wp-content/uploads/2022/09/Practical-Linux-Unix-Tee-Commands-for-the-Linux-Admin.jpg)

### [Master Unix tee Commands for Real-World Linux Admin Tasks](/unix-tee/)

Simplify Linux output management and streamline your workflow with the “Unix tee” command. This tutorial guides you through its practical applications.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)