# Setting up sending Linux logs to central Syslog server

**URL:** <https://forums.suse.com/t/setting-up-sending-linux-logs-to-central-syslog-server/27388>\
**Category:** SLES Configure-Administer\
**Created:** [August 28, 2015, 7:37pm UTC](https://forums.suse.com/t/setting-up-sending-linux-logs-to-central-syslog-server/27388 "2015-08-28T19:37:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PeterHands](https://avatars.discourse-cdn.com/v4/letter/p/9f8e36/32.png) [@PeterHands](https://forums.suse.com/u/PeterHands)\
**Post date:** [August 28, 2015, 7:37pm UTC](https://forums.suse.com/t/setting-up-sending-linux-logs-to-central-syslog-server/27388/1 "2015-08-28T19:37:27Z")

</div>

Hi,

Im fairly new to Linux, but ive been tasked with sending all linux logs to a central syslog server.

Sorry to ask but are there any guides out there on how to do this?

These are SLES 11 machines

---

<div class="post-metadata">

**Author:** ![x0500hl](https://avatars.discourse-cdn.com/v4/letter/x/7bcc69/32.png) [@x0500hl](https://forums.suse.com/u/x0500hl)\
**Post date:** [August 28, 2015, 10:05pm UTC](https://forums.suse.com/t/setting-up-sending-linux-logs-to-central-syslog-server/27388/2 "2015-08-28T22:05:22Z")

</div>

I don’t know of any guides but this is how I accomplished it:

cd /etc/syslog-ng  
cp -p syslog-ng.conf syslog-ng.conf.new  
vi syslog-ng.conf.new  
Uncomment the last two lines and modify the first line. The modification is in bold.

# 

# Enable this and adopt IP to send log messages to a log server.

# 

destination logserver { udp(“your\_log\_server\_DNS\_goes\_here” port(514)); };  
log { source(src); destination(logserver); };  
:wq

To implement:  
cd /etc/syslog-ng  
mv syslog-ng.conf.new syslog-ng.conf

/etc/rc.d/syslog restart

Hope this helps.

Harley

---

<div class="post-metadata">

**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\
**Post date:** [August 31, 2015, 1:19pm UTC](https://forums.suse.com/t/setting-up-sending-linux-logs-to-central-syslog-server/27388/3 "2015-08-31T13:19:00Z")

</div>

Hi PeterHands,

[QUOTE=PeterHands;29391]Hi,

Im fairly new to Linux, but ive been tasked with sending all linux logs to a central syslog server.

Sorry to ask but are there any guides out there on how to do this?

These are SLES 11 machines[/QUOTE]

It’d be helpful to add a little detail to your question:  
a - what vresion of SLES11 (SP4 is latest, saying “SLES11” would usually mean the version without any service packs, which would be horrendously outdated)  
b - which syslog are you using, “syslog-ng” (as Harley was referring to) or rsyslog?

There are two sides to your question:

1. How to make the clients send their syslogs to the central syslog server? This part was answered by Harley for syslog-ng, using udp packets. With rsyslog, have a look at /etc/rsyslog.d/remote.conf
2. How to make the central syslog server receive these messages, and store them comfortably?

If the central server is syslog-ng (rather typical for i.e. SLES11SP3), then you’ll need to tell it to listen for the incoming packets i.e. via the following “source” declaration in /etc/syslog-ng/syslog-ng.conf:

` [FONT=monospace][COLOR=#000000]source net { [/COLOR]
        udp(ip([COLOR=#b21818]"0.0.0.0"[/COLOR][COLOR=#000000]) port(514)); [/COLOR]
};`

In addition, you’ll have to tell syslog-ng what to do with these messages (no current rule will reference the source named “net” yet). I have decided to keep all messages in separate files per sending host, as not to mix too many message sources in a single file:

`[/FONT]
[FONT=monospace] [/FONT] [FONT=monospace][COLOR=#1818b2]# remote logging[/COLOR][COLOR=#000000] [/COLOR]
destination remotemessages { file( [COLOR=#b21818]"/var/log/hosts/$HOST.log"[/COLOR][COLOR=#000000]); }; [/COLOR]
log { source(net); destination( remotemessages); };`  
As you can see, these files even go in a separate subdirectory. You’ll need to adopt your logrotation rules to that, though: Else you’ll end up with pretty large files clobbering your /var/log/hosts file system…

Regards,  
Jens  
[/FONT]  
[FONT=monospace] [/FONT]

---

<div class="post-metadata">

**Author:** ![swadm](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@swadm](https://forums.suse.com/u/swadm)\
**Post date:** [September 1, 2015, 10:19am UTC](https://forums.suse.com/t/setting-up-sending-linux-logs-to-central-syslog-server/27388/4 "2015-09-01T10:19:54Z")

</div>

there is also an Novell Cool Solutions article on doing this with syslog-ng:

[Centralized Syslogging with Syslog-NG on SUSE Linux](https://www.novell.com/coolsolutions/feature/18044.html)