How to Export Your Servers Logs with Rsyslog in Centos 8

In this post, you will learn how to Export Your Servers Logs with Rsyslog in Centos 8

In this article, we’ll walk through setting up a CentOS/RHEL 8 Rsyslog daemon to deliver log messages to a remote Rsyslog server. This configuration ensures that disc space on your machine is available for other purposes.

In CentOS 8, the Rsyslog daemon is already installed and operating by default. Issue the following commands to see if the rsyslog service is active on the system.

# grep rsyslog | rpm –q 

# rsyslogd –v 

If the Rsyslog package is not installed on your CentOS system, run the command below to install it.

# yum install rsyslog

Export Your Servers Logs with Rsyslog

Modify the rsyslog configuration file as follows to force the Rsyslog daemon installed on a CentOS 8 system to function as a log client and send all locally generated log messages to a distant Rsyslog server:

To begin altering, open the main configuration file:

# vim /etc/rsyslog.conf

Then, as shown in the excerpt below, append the following line to the end of the file.

# *. *  @192.168.1.59:514

Make sure the IP address and FQDN of the remote rsyslog server are replaced appropriately in the above line. The preceding line tells the Rsyslog daemon to send all log messages to the IP 192.168.1.59 over the 514/UDP port, regardless of facility or severity.

Add another @ character in front of the remote host if the remote log server is configured to only accept TCP connections or if you want to utilise a dependable transport network protocol like TCP, as illustrated in the example below:

# *. *  @@logs.domain.lan:514

Special characters, such as = or!, can be prefixed to priority levels in Linux rsyslog to signal “this priority only” for equal sign and “not this priority or higher than this” for!

Below are some examples of Rsyslog priority level qualifiers:

kern.info = Kernel logs with a priority of information or higher.
kern.=info = Only kernel messages with the priority of information are allowed.
kern.info;kern.!err = Only kernel messages with the priorities info, notice, and warning are allowed.
kern.debug;kern.!=warning = Except for warning, all kernel priority are equal.
kern.* = All messages with a priority in the kernel
kern.none = Regardless of priority, do not log any associated kernel facility messages.

For example, if you just want to send a subset of facility messages to a remote log server, such as all associated mail messages regardless of priority, add the following line to the rsyslog configuration file:

# mail.* @192.168.1.59:514

Finally, in order for the updated settings to take effect, the Rsyslog service must be restarted with the following command:

# systemctl restart rsyslog.service

If the Rsyslog daemon is not activated during boot time for some reason, run the command following to enable the service system-wide:

# systemctl enable rsyslog.service

Send Web Server Logs to a Remote Log Server

By adding the following line to Apache’s main configuration file, as shown below, the HTTP server can be configured to transmit log messages to a remote syslog server.

# vim /etc/httpd/conf/httpd.conf

On Apache main conf file add the below line.

CustomLog "| /bin/sh -c '/usr/bin/tee -a /var/log/httpd/httpd-access.log | /usr/bin/logger -thttpd -plocal1.notice'" combined

The line tells the HTTP daemon to write log messages to the filesystem log file, but it also tells it to send them to a faraway syslog server by designating them as coming from the local1 facility.

If you wish to send Apache error log messages to a remote syslog server as well, create a new rule similar to the one given above, but change the name of the httpd log file and the severity level of the log file to match the error priority, as shown in the following example:

ErrorLog "|/bin/sh -c '/usr/bin/tee -a /var/log/httpd/httpd-error.log | /usr/bin/logger -thttpd -plocal1.err'"

After you’ve changed the above lines, you’ll need to restart the Apache daemon to see the changes take effect:

# systemctl restart httpd.service

By adding the following lines of code to a nginx configuration file, the Nginx web server has built-in capability to directly log its messages to a remote syslog server as of version 1.7.1.

error_log syslog:server=192.168.1.59:514,facility=local7,tag=nginx,severity=error;
access_log syslog:server=192.168.1.59:514,facility=local7,tag=nginx,severity=info main;/code>

To receive the logs sent by the Apache web server, make the following changes to the rsyslog configuration file on the remote Rsyslog server.

local1.* @Apache_IP_address:514

That concludes our discussion. You’ve successfully setup the Rsyslog daemon to run in client mode, as well as directed Apache or Nginx to route log messages to a remote syslog server.

If your system breaks, you should be able to figure out what went wrong by looking at the contents of the log files saved on the remote syslog server.

Now you know how to export Your Servers Logs using Rsyslog.

Check out our homepage for more guides