How To Monitor & Analyze System Events With Rsyslog Server

Rsyslog is an open-source logging software that allows system administrators to centralize log files from multiple servers into a single location. By forwarding logs to a centralized server, administrators can easily monitor and analyze system events, making troubleshooting and security management more efficient. In this guide, we will walk you through the process of setting up an Rsyslog server on a Debian 11 system.

Prerequisites

To get started, make sure you have the following:

Two servers running Debian 11
Root access to the servers

Step 1: Installing Rsyslog

The first step is to install the Rsyslog server package on your Debian 11 server. Open the terminal and run the following command:

sudo apt-get install rsyslog -y

Once the installation is complete, you can verify the status of the Rsyslog service by running:

sudo systemctl status rsyslog

If the service is active and running, you should see output similar to the following:

● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2021-10-03 13:35:32 UTC; 1h 44min ago
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Main PID: 283 (rsyslogd)
Tasks: 4 (limit: 2341)
Memory: 5.0M
CPU: 90ms
CGroup: /system.slice/rsyslog.service
└─283 /usr/sbin/rsyslogd -n -iNONE

Step 2: Configuring Rsyslog

Once Rsyslog is installed, you need to configure it to run in server mode. Open the Rsyslog configuration file using your preferred text editor. In this example, we will use nano:

sudo nano /etc/rsyslog.conf

Next, uncomment the following lines to enable UDP and TCP syslog reception:

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

After that, add the following lines to define a template for storing incoming logs from client systems:

$template remote-incoming-logs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?remote-incoming-logs

Save and close the file. To apply the changes, restart the Rsyslog service:

sudo systemctl restart rsyslog

To verify that Rsyslog is listening on port 514, you can use the following command:

sudo ss -tunlp | grep 514

You should see output similar to the following:

udp UNCONN 0 0 0.0.0.0:514 0.0.0.0:* users:(("rsyslogd",pid=26276,fd=6))
udp UNCONN 0 0 [::]:514 [::]:* users:(("rsyslogd",pid=26276,fd=7))
tcp LISTEN 0 25 0.0.0.0:514 0.0.0.0:* users:(("rsyslogd",pid=26276,fd=8))
tcp LISTEN 0 25 [::]:514 [::]:* users:(("rsyslogd",pid=26276,fd=9))

Step 3: Configuring the Firewall for Rsyslog

To allow incoming syslog traffic on port 514, you need to configure the firewall. If you are using UFW (Uncomplicated Firewall), you can use the following commands:

sudo ufw allow 514/tcp
sudo ufw allow 514/udp
sudo ufw reload

Step 4: Configuring Rsyslog Clients

Now that the Rsyslog server is set up, you need to configure the clients to send their log files to the server. Open the Rsyslog configuration file on each client machine:

sudo nano /etc/rsyslog.conf

At the end of the file, add the following lines to enable sending system logs over UDP and TCP to the Rsyslog server:

# Enable sending system logs over UDP to Rsyslog server
*.* @rsyslog-server-ip:514

# Enable sending system logs over TCP to Rsyslog server
*.* @@rsyslog-server-ip:514

Replace rsyslog-server-ip with the IP address of your Rsyslog server.

Additionally, you can configure the clients to store logs in a disk queue when the Rsyslog server is unavailable. This can be done by adding the following lines:

$ActionQueueFileName queue
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1

Save and close the file, then restart the Rsyslog service on each client:

sudo systemctl restart rsyslog

Step 5: Verifying Log Files on the Server

All log files from the clients are stored in the /var/log directory on the Rsyslog server. You can navigate to this directory and list the log files using the following command:

ls -l /var/log/

You should see the log files corresponding to the hostnames of the client systems. For example:

alternatives.log
auth.log.2.gz
daemon.log
debian11dpkg.log
kern.log.1
messages.1
private
syslog.3.gz
clientpc
auth.log.3.gz
daemon.log.1
debugdpkg.log.1
kern.log.2.gz
messages.2.gz
runit
syslog.4.gz
apt
btmp
daemon.log.3.gz
debug.2.gzicinga2
kern.log.4.gz
messages.4.gz
syslogauth.log.1
csm.log
dbconfig-common
debug.4.gzkern.log
messages
ntpstats
syslog.2.gz

Conclusion

In this guide, we have walked you through the process of setting up an Rsyslog server on Debian 11. By following these steps, you can centralize your system logs and easily monitor your clients from a single location. Rsyslog is a powerful tool for efficient log management and can greatly enhance your system administration capabilities.

For businesses looking for reliable and scalable cloud hosting solutions, Shape.host offers Cloud VPS services tailored to meet your specific needs. With Shape.host, you can enjoy high-performance virtual servers, advanced security features, and exceptional customer support. Visit Shape.host to learn more about our services.

If you have any questions or need further assistance, feel free to reach out to our team. Happy logging!