How To Setup Rsyslog on Ubuntu 20.04 LTS

In this tutorial, we will show you how to setup Rsyslog on Ubuntu 20.04 LTS. For those of you who didn’t know, Rsyslog is an open-source software tool for Unix-based operating systems used for collecting log messages from multiple network devices. It helps system administrators to keep an eye on all servers from the central point. Rsyslog works in a client/server model, it receives logs from the remote client on port 514 over the TCP/UDP protocol.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Rsyslog on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

Prerequisites

• A server running one of the following operating systems: Ubuntu 20.04, 18.04, and any other Debian-based distribution like Linux Mint.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Setup Rsyslog on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing Rsyslog on Ubuntu 20.04.

By default, Rsyslog is now available on the Ubuntu base repository. Now we run the following command below to install the Rsyslog server package on your system:

sudo apt install rsyslog

Once the installation is done, start and enable the Rsyslog service:

sudo systemctl start rsyslog
sudo systemctl enable rsyslog
sudo systemctl status rsyslog

Step 3. Configure Rsyslog.

Now it’s time to go to rsyslog.conf file, to uncomment and change some lines to run Rsyslog service in server mode:

nano /etc/rsyslog.conf

Uncomment the following lines:

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

After that, add the following lines to define the template to store incoming logs from client systems:

$template remote-incoming-logs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?remote-incoming-logs

Save and close, then restart the Rsyslog service for the changes to take effect:

sudo systemctl restart rsyslog

Step 4. Configure Firewall.

If the firewall is running, open Rsyslog through it:

ufw allow 514/tcp
ufw allow 514/udp
ufw reload

Step 5. Configure Rsyslog as a Client.

Now, you will need to configure the Rsyslog client to send Syslog messages to the remote Rsyslog server:

nano /etc/rsyslog.conf

Add the following line:

#Enable sending system logs over UDP to rsyslog server
*.* @rsyslog-server-ip:514

#Enable sending system logs over TCP to rsyslog server
*.* @@rsyslog-server-ip:514

##Set disk queue when rsyslog server will be down:

$ActionQueueFileName queue
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1

Save and close the file then restart the Rsyslog service to apply the changes:

sudo systemctl restart rsyslog

All client’s log files are stored in the /var/log directory on the server. You should see the entry with the hostname of your client machines including several log files:

ls -l /var/log/

Congratulations! You have successfully installed Rsyslog. Thanks for using this tutorial for installing the Rsyslog on Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official Rsyslog website.