How To Setup Rsyslog on Ubuntu 20.04 LTS

Setup Rsyslog on Ubuntu 20.04

In this tutorial, we will show you how to setup Rsyslog on Ubuntu 20.04 LTS. Before we delve into the installation and configuration process, let’s take a moment to understand what Rsyslog is and how it differs from traditional syslog. Rsyslog is an enhanced version of the standard syslog protocol, offering advanced features and capabilities. It serves as a centralized logging system that collects log messages from various devices and applications, allowing for efficient analysis and troubleshooting.

One of the key advantages of Rsyslog over traditional syslog is its modular architecture. This modular design enables Rsyslog to support a wide range of input and output modules, making it highly extensible and adaptable to different logging scenarios. Additionally, Rsyslog offers improved performance, reliability, and security features, making it a robust choice for enterprise-level logging.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Rsyslog on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.


  • A server running one of the following operating systems: Ubuntu 20.04, 18.04, and any other Debian-based distribution like Linux Mint.
  • It’s recommended that you use a fresh OS install to prevent any potential issues.
  • SSH access to the server (or just open Terminal if you’re on a desktop).
  • A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Setup Rsyslog on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing Rsyslog on Ubuntu 20.04.

By default, Rsyslog is now available on the Ubuntu base repository. Now we run the following command below to install the Rsyslog server package on your system:

sudo apt install rsyslog

After the installation is complete, you can verify the installation by running the following command:

rsyslogd -v

Next, start and enable the Rsyslog service:

sudo systemctl start rsyslog
sudo systemctl enable rsyslog
sudo systemctl status rsyslog

Step 3. Configure Rsyslog.

Now it’s time to go to rsyslog.conf file, to uncomment and change some lines to run Rsyslog service in server mode:

nano /etc/rsyslog.conf

Uncomment the following lines:

# provides UDP syslog reception
input(type="imudp" port="514")

# provides TCP syslog reception
input(type="imtcp" port="514")

After that, add the following lines to define the template to store incoming logs from client systems:

$template remote-incoming-logs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?remote-incoming-logs

Save and close, then restart the Rsyslog service for the changes to take effect:

sudo systemctl restart rsyslog

Step 4. Configure Firewall.

If the firewall is running, open Rsyslog through it:

ufw allow 514/tcp
ufw allow 514/udp
ufw reload

Step 5. Configure Rsyslog as a Client.

Now, you will need to configure the Rsyslog client to send Syslog messages to the remote Rsyslog server:

nano /etc/rsyslog.conf

Add the following line:

#Enable sending system logs over UDP to rsyslog server
*.* @rsyslog-server-ip:514

#Enable sending system logs over TCP to rsyslog server
*.* @@rsyslog-server-ip:514
##Set disk queue when rsyslog server will be down:

$ActionQueueFileName queue
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1

Save and close the file then restart the Rsyslog service to apply the changes:

sudo systemctl restart rsyslog

All client’s log files are stored in the /var/log directory on the server. You should see the entry with the hostname of your client machines including several log files:

ls -l /var/log/

Congratulations! You have successfully installed Rsyslog. Thanks for using this tutorial for installing the Rsyslog on Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official Rsyslog website.

VPS Manage Service Offer
If you don’t have time to do all of this stuff, or if this is not your area of expertise, we offer a service to do “VPS Manage Service Offer”, starting from $10 (Paypal payment). Please contact us to get the best deal!


r00t is a seasoned Linux system administrator with a wealth of experience in the field. Known for his contributions to, r00t has authored numerous tutorials and guides, helping users navigate the complexities of Linux systems. His expertise spans across various Linux distributions, including Ubuntu, CentOS, and Debian. r00t's work is characterized by his ability to simplify complex concepts, making Linux more accessible to users of all skill levels. His dedication to the Linux community and his commitment to sharing knowledge makes him a respected figure in the field.
Back to top button