diff --git a/linux/remoteRsyslog/remoteRsyslogServer.sh b/linux/remoteRsyslog/remoteRsyslogServer.sh new file mode 100644 index 0000000..f63ec19 --- /dev/null +++ b/linux/remoteRsyslog/remoteRsyslogServer.sh @@ -0,0 +1,6 @@ + +# Please note that in debian 12 bookworm you will need to +# install rsyslogd with apt install rsyslog +mkdir -p /var/log/remote +chown syslog:adm /var/log/remote + diff --git a/linux/remoteRsyslog/rsyslog.conf-recieve b/linux/remoteRsyslog/rsyslog.conf-recieve new file mode 100644 index 0000000..45f1317 --- /dev/null +++ b/linux/remoteRsyslog/rsyslog.conf-recieve @@ -0,0 +1,12 @@ +#add +# provides UDP syslog reception +module(load="imudp") +input(type="imudp" port="514") + +# provides TCP syslog reception +module(load="imtcp") +input(type="imtcp" port="514") + +$template RemoteLogs,"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log" +*.* ?RemoteLogs + diff --git a/linux/remoteRsyslog/rsyslog.conf-send b/linux/remoteRsyslog/rsyslog.conf-send new file mode 100644 index 0000000..830cf59 --- /dev/null +++ b/linux/remoteRsyslog/rsyslog.conf-send @@ -0,0 +1,8 @@ +# in /etc/rsyslog.conf +# add in the sending rsyslogd +# use @@ or @ not BOTH! +# +*.* @@192.168.100.2:514 # for tcp +#*.* @192.168.100.2:514 # for udp +# @@ = tcp +# @ = udp