What is rsyslog?
rsyslog is an open-source logging service (daemon) that implements syslog on Linux and other Unix-like systems. The project describes it as the "rocket-fast system for log processing". It is the default syslog daemon on many Linux distributions, where it collects messages from the kernel, services and applications, sorts them by facility and severity, and writes them to files under /var/log. It can also send those messages to a central syslog server, or be that central server itself.
On distributions that use systemd, rsyslog often runs alongside the systemd journal, receiving messages from it and writing traditional text log files.
Configuration files
/etc/rsyslog.conf: the main configuration file./etc/rsyslog.d/: extra.conffiles that the main file normally includes, a tidy place for your own rules.
A classic rule pairs a selector (facility.severity) with an action. For example, auth,authpriv.* /var/log/auth.log writes all authentication messages to one file. After editing, restart the service with sudo systemctl restart rsyslog and send a test message with logger "test message".
Forwarding logs to a syslog server
To send every message to a central server, add a line like one of these (classic syntax):
| Rule | Transport |
|---|---|
*.* @192.168.1.50:514 | UDP (a single @) |
*.* @@192.168.1.50:514 | TCP (a double @@) |
UDP port 514 is the traditional syslog transport. It's simple but has no delivery confirmation, so messages can be lost when the network or server is busy. TCP (by convention also port 514) delivers more reliably, and rsyslog can be configured to queue messages while the server is unreachable. For logs that cross untrusted networks, rsyslog supports syslog over TLS, which conventionally uses port 6514.
To make rsyslog the central server, load its UDP or TCP input module and listen on port 514, for example module(load="imudp") followed by input(type="imudp" port="514").
rsyslog and related tools
- syslog-ng: another full-featured syslog daemon with its own configuration language.
- systemd-journald: the systemd log service, which keeps logs in a binary journal you read with
journalctl. - SIEM platforms: often receive the logs rsyslog forwards, for searching, correlation and alerting.
For the CompTIA A+ exam
Core 1 (220-1201) objective 2.3 lists syslog among the server roles. Know the idea of a central syslog server collecting logs from many devices, that classic syslog uses UDP port 514, and that rsyslog is a common Linux syslog daemon configured through /etc/rsyslog.conf.