In this tutorial, we will show you how to setup Rsyslog on Ubuntu 20.04 LTS. For those of you who didn’t know, Rsyslog is an open-source software tool for Unix-based operating systems used for collecting log messages from multiple network devices. It helps system administrators to keep an eye on all servers from the central point. Rsyslog works in a client/server model, it receives logs from the remote client on port 514 over the TCP/UDP protocol.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘
sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Rsyslog on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.
Setup Rsyslog on Ubuntu 20.04 LTS Focal Fossa
Step 1. First, make sure that all your system packages are up-to-date by running the following
apt commands in the terminal.
sudo apt update sudo apt upgrade
Step 2. Installing Rsyslog on Ubuntu 20.04.
By default, Rsyslog is now available on the Ubuntu base repository. Now we run the following command below to install the Rsyslog server package on your system:
sudo apt install rsyslog
Once the installation is done, start and enable the Rsyslog service:
sudo systemctl start rsyslog sudo systemctl enable rsyslog sudo systemctl status rsyslog
Step 3. Configure Rsyslog.
Now it’s time to go to
rsyslog.conf file, to uncomment and change some lines to run Rsyslog service in server mode:
Uncomment the following lines:
# provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") # provides TCP syslog reception module(load="imtcp") input(type="imtcp" port="514")
After that, add the following lines to define the template to store incoming logs from client systems:
$template remote-incoming-logs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log" *.* ?remote-incoming-logs
Save and close, then restart the Rsyslog service for the changes to take effect:
sudo systemctl restart rsyslog
Step 4. Configure Firewall.
If the firewall is running, open Rsyslog through it:
ufw allow 514/tcp ufw allow 514/udp ufw reload
Step 5. Configure Rsyslog as a Client.
Now, you will need to configure the Rsyslog client to send Syslog messages to the remote Rsyslog server:
Add the following line:
#Enable sending system logs over UDP to rsyslog server *.* @rsyslog-server-ip:514 #Enable sending system logs over TCP to rsyslog server *.* @@rsyslog-server-ip:514
##Set disk queue when rsyslog server will be down: $ActionQueueFileName queue $ActionQueueMaxDiskSpace 1g $ActionQueueSaveOnShutdown on $ActionQueueType LinkedList $ActionResumeRetryCount -1
Save and close the file then restart the Rsyslog service to apply the changes:
sudo systemctl restart rsyslog
All client’s log files are stored in the
/var/log directory on the server. You should see the entry with the hostname of your client machines including several log files:
ls -l /var/log/
Congratulations! You have successfully installed Rsyslog. Thanks for using this tutorial for installing the Rsyslog on Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official Rsyslog website.