{"id":8405,"date":"2021-03-25T22:59:06","date_gmt":"2021-03-25T19:59:06","guid":{"rendered":"https:\/\/kifarunix.com\/?p=8405"},"modified":"2024-03-19T18:28:08","modified_gmt":"2024-03-19T15:28:08","slug":"setup-rsyslog-server-on-ubuntu-20-04","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/setup-rsyslog-server-on-ubuntu-20-04\/","title":{"rendered":"Setup Rsyslog Server on Ubuntu 20.04"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to setup rsyslog server on Ubuntu 20.04. <a rel=\"noreferrer noopener\" href=\"https:\/\/www.rsyslog.com\/\" target=\"_blank\" class=\"rank-math-link\">Rsyslog<\/a> is a multi-threaded implementation of syslogd (a system utility providing support for message logging), with features that include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>reliable syslog over TCP, SSL\/TLS and RELP<\/li>\n\n\n\n<li>on-demand disk buffering<\/li>\n\n\n\n<li>email alerting<\/li>\n\n\n\n<li>writing to MySQL or PostgreSQL databases (via separate output plugins)<\/li>\n\n\n\n<li>permitted sender lists<\/li>\n\n\n\n<li>filtering on any part of the syslog message<\/li>\n\n\n\n<li>on-the-wire message compression<\/li>\n\n\n\n<li>fine-grained output format control<\/li>\n\n\n\n<li>failover to backup destinations<\/li>\n\n\n\n<li>enterprise-class encrypted syslog relaying<br>.<br>It is the default syslogd on Debian systems.<\/li>\n<\/ul>\n\n\n\n<p>Rsyslog can be configured in a client\/server model. When configured as a client, it sends logs to a remote server over the network via TCP\/UDP protocols. As a server, it receives logs over the network from remote client on port 514 TCP\/UDP or any custom port on which it is configured to listen on.<\/p>\n\n\n\n<p>Rsyslog filters syslog messages based on selected filters. You may want to check out our previous article on&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/kifarunix.com\/howtos\/a-basic-introduction-to-rsyslog-filters\/\" target=\"_blank\">basic introduction to rsyslog filters<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configuring Rsyslog Server on Ubuntu 20.04<\/h2>\n\n\n\n<p>Are you using Debian 10? Check the link below;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/setup-rsyslog-server-on-debian-10\/\" target=\"_blank\" aria-label=\" (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Setup Rsyslog Server on Debian 10<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Install Rsyslog on Ubuntu 20.04<\/h4>\n\n\n\n<p>Rsyslog is the default syslogd on Debian systems and is usually installed on Ubuntu 20.04 by default.<\/p>\n\n\n\n<p>You can verify this by checking the version of installed rsyslog.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt list -a rsyslog<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>Listing... Done\nrsyslog\/focal-updates,now 8.2001.0-1ubuntu1.1 amd64 [<strong>installed<\/strong>,automatic]\nrsyslog\/focal 8.2001.0-1ubuntu1 amd64<\/code><\/pre>\n\n\n\n<p>If for any reasons it is not installed, run the command below to install it.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt update<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt&nbsp;install&nbsp;rsyslog -y<\/code><\/pre>\n\n\n\n<p>Once the installation is done, start and enable the rsyslog service.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl enable --now rsyslog<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Setting up Rsyslog Server<\/h4>\n\n\n\n<p>Now that rsyslog is installed and running, you need to configure it to run in server mode. As stated above, rsyslog can be configured as client to sent logs to a central logging server or a server to receive and store logs from other systems.<\/p>\n\n\n\n<p>In this guide, we setup Rsyslog as a server on an Ubuntu 20.04 box.<\/p>\n\n\n\n<p>Open the ryslog configuration file for editing;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/rsyslog.conf<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Define Rsyslog Server Protocol and Port<\/h5>\n\n\n\n<p>To begin with, define the protocol and port you want to receive logs on.<\/p>\n\n\n\n<p>You can choose to use UDP or TCP and any port of your choice.<\/p>\n\n\n\n<p>Note that TCP syslog reception is way more reliable than UDP syslog and still pretty fast. The main reason is, that UDP might suffer of message loss. This happens when the syslog server must receive large bursts of messages. If the system buffer for UDP is full, all other messages will be dropped. With TCP, this will not happen. But sometimes it might be good to have a UDP server configured as well. That is, because some devices (like routers) are not able to send TCP syslog by design. In that case, you would need both syslog server types to have everything covered.<\/p>\n\n\n\n<p>In this setup, we will configure Rsyslog to use both UDP and TCP protocols for logs reception over the ports 514 and 50514 respectively.<\/p>\n\n\n\n<p>By default UDP syslog is received on port 514.<\/p>\n\n\n\n<p>Enable UDP syslog reception:<\/p>\n\n\n\n<p>Within the <strong>\/etc\/rsyslog.conf<\/strong>&nbsp;configuration file, uncomment the lines for UDP syslog reception in the&nbsp;<strong>MODULES<\/strong>&nbsp;section as shown below;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>...\n#################\n#### MODULES ####\n#################\n...\n\n# provides UDP syslog reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\")\n<\/code><\/pre>\n\n\n\n<p>Enable TCP syslog reception:<\/p>\n\n\n\n<p>TCP syslog may need to use a different port because often the RPC service is using this port as well.<\/p>\n\n\n\n<p>To set rsyslog to run on a different TCP port, say TCP port,&nbsp;<strong>50514<\/strong>, uncomment the TCP reception lines and change the port as shown below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code># provides TCP syslog reception\n<strong>module(load=\"imtcp\")<\/strong>\n<strong>input(type=\"imtcp\" port=\"50514\")<\/strong><\/code><\/pre>\n\n\n\n<p>Save and exit the file;<\/p>\n\n\n\n<p>Restart rsyslog service;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl restart rsyslog<\/code><\/pre>\n\n\n\n<p>Verify that rsyslog is now listening on two ports;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ss -4altunp | grep 514<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>udp    UNCONN  0       0                   0.0.0.0:514            0.0.0.0:*      users:((\"rsyslogd\",pid=52382,fd=5))                                            \ntcp    LISTEN  0       25                  0.0.0.0:50514          0.0.0.0:*      users:((\"rsyslogd\",pid=52382,fd=7))<\/code><\/pre>\n\n\n\n<p><strong>You may notice that UDP port has no LISTEN state because it is connectionless and&nbsp;has no concept of \u201clistening\u201d, \u201cestablished\u201d, \u201cclosed\u201d, or anything like that.<\/strong><\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Allow Rsyslog through Firewall<\/h5>\n\n\n\n<p>If firewall is running, open rsyslog through it.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ufw allow 514\/udp<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ufw allow 50514\/tcp<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Define Allowed Senders<\/h5>\n\n\n\n<p>You may also want to explicitly set the remote clients that are allowed to to send syslog messages to rsyslogd. To achieve this, you can set a global directive using the&nbsp;<strong>$AllowedSender<\/strong>&nbsp;directive.<\/p>\n\n\n\n<p>Allowed sender lists can be defined for UDP and TCP senders separately. The syntax to specify them is:<\/p>\n\n\n\n<p><code><strong>$AllowedSender [UDP\/TCP], ip[\/bits], ip[\/bits]<\/strong><\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>ip[\/bits]<\/strong>&nbsp;is a machine or network ip address as in \u201c192.0.2.0\/24\u201d or \u201c192.0.2.10\u201d. If the&nbsp;<strong>\/bits<\/strong>&nbsp;part is omitted, a single host is assumed. \u201c\/0\u201d is not allowed, because that would match any sending system.<\/li>\n\n\n\n<li><strong>Hostnames<\/strong>, with and without wildcards, may also be provided. If so, the result of revers DNS resolution is used for filtering. Multiple allowed senders can be specified in a comma-delimited list.<\/li>\n<\/ul>\n\n\n\n<p>It is good to specify senders with high traffic volume before those with lower volume.<\/p>\n\n\n\n<p>To allow specific hosts for either UDP or TCP logging, enter the following lines;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/rsyslog.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>...\n###########################\n#### GLOBAL DIRECTIVES ####\n###########################\n# $AllowedSender - specifies which remote systems are allowed to send syslog messages to rsyslogd\n<strong>$AllowedSender UDP, 192.168.57.0\/24, [::1]\/128, *.example.net, servera.example.com\n$AllowedSender TCP, 192.168.58.0\/24, [::1]\/128, *.example.net, servera.example.com<\/strong><\/code><\/pre>\n\n\n\n<p>The hostnames must be resolvable since before ACL is updated, they will be resolved into their individual IPs.<\/p>\n\n\n\n<p>Also note that the above directives only allow UDP reception from <strong>192.168.57.0\/24<\/strong> and TCP reception from <strong>192.168.58.0\/24<\/strong>.<\/p>\n\n\n\n<p>As much as allowing specific hosts via this directive, a good idea to impose allowed sender limitations via firewalling.<\/p>\n\n\n\n<p>For example, to allow hosts from the <strong>192.168.57.0\/24<\/strong> and <strong>192.168.58.0\/24<\/strong> networks;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ufw allow from <strong>192.168.57.0\/24<\/strong> to any port 514 proto udp\nufw allow from <strong>192.168.57.0\/24<\/strong> to any port 50514 proto tcp<\/code><\/pre>\n\n\n\n<pre id=\"block-4f7222eb-eebe-4b62-b1e4-29f91ff45f90\" class=\"wp-block-preformatted\">ufw allow from <strong>192.168.58.0\/24<\/strong> to any port 514 proto udp\nufw allow from <strong>192.168.58.0\/24<\/strong> to any port 50514 proto tcp<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Configure Rsyslog Template<\/h5>\n\n\n\n<p>Templates are a key feature of rsyslog. Any output that is generated by rsyslog can be modified and formatted according to your needs with the use of templates.<\/p>\n\n\n\n<p>To create a template use the following syntax in&nbsp;<strong>\/etc\/rsyslog.conf<\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>$template <em>TEMPLATE_NAME<\/em>,\"<em>text %PROPERTY% more text<\/em>\", [<em>OPTION<\/em>]<\/code><\/pre>\n\n\n\n<p>Thus, we can create our template like;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code># provides TCP syslog reception\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"50514\")\n\n#Custom template to generate the log filename dynamically based on the client's IP address.\n<strong>$template RemInputLogs, \"\/var\/log\/remotelogs\/%FROMHOST-IP%\/%PROGRAMNAME%.log\"<\/strong>\n<strong>*.* ?RemInputLogs<\/strong><\/code><\/pre>\n\n\n\n<p>This will categorize logs received from remote host into log files for specific programs responsible for the generation of that log.<\/p>\n\n\n\n<p>Once you are done with configuration, save and exit the file;<\/p>\n\n\n\n<p>You can now restart the&nbsp;<code>rsyslog<\/code>&nbsp;service by running the command below. Before you can restart rsyslogd, run a configuration check.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>rsyslogd -f \/etc\/rsyslog.conf -N1<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>rsyslogd: version 8.2001.0, config validation run (level 1), master config \/etc\/rsyslog.conf\n rsyslogd: End of config validation run. Bye.<\/code><\/pre>\n\n\n\n<p>If all is well, proceed to restart rsyslog.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl restart rsyslog<\/code><\/pre>\n\n\n\n<p>Rsyslogd is now ready to receive logs from remote hosts.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configure-logging-client\">Configure Remote Rsyslog Client to Forward logs Rsyslog Server<\/h3>\n\n\n\n<p>Now it is time to configure the remote client to send syslog messages to the remote syslog server. Login and proceed as follows.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Verify Remote Rsyslog Server Ports Connection<\/h4>\n\n\n\n<p>To verify connectivity to remote rsyslog server TCP port 50514, run the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code><strong>telnet 192.168.57.3 50514<\/strong><\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>Trying 192.168.57.3...\nConnected to 192.168.57.3.\nEscape character is '^]'.\n^]\n\ntelnet&gt;<\/code><\/pre>\n\n\n\n<p>Verify connectivity to UDP port 514. Since you cannot telnet to UDP port 514, use netcat command. On the server, run the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nc -ul 514<\/code><\/pre>\n\n\n\n<p>On the client, run the command below, press ENTER and type anything. You should be able to see what you type on the server.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nc -u 192.168.57.3 514<\/code><\/pre>\n\n\n\n<p>If all is good, edit the client system rsyslog configuration file as shown below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/rsyslog.conf<\/code><\/pre>\n\n\n\n<p>To send authentication logs over port 514\/UDP, add the following line at the end of the file. Note, this should be done from hosts under the <strong>192.168.57.0\/24<\/strong> as per the <strong><code>AllowedSender<\/code><\/strong> directive.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code># Send logs to remote syslog server over UDP\n<strong>auth,authpriv.* @192.168.57.3:514<\/strong><\/code><\/pre>\n\n\n\n<p>To send all logs over port 50514\/TCP, add the following line at the end of the file. Note, this should be done from hosts under the <strong>192.168.58.0\/24<\/strong> as per the AllowedSender directive.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code># Send logs to remote syslog server over TCP 50514\n<strong>*.* @@192.168.57.3:50514<\/strong><\/code><\/pre>\n\n\n\n<p>As a cushion just in case the remote rsyslog server goes down and your logs are so important you don\u2019t want to loose, set the rsyslog disk queue for buffering in the rsyslog configuration file as shown below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code># Define Disk Queue Buffer in case the server goes down\n<strong>$ActionQueueFileName queue<\/strong> # define a file name for disk assistance.\n<strong>$ActionQueueMaxDiskSpace 1g<\/strong>  # The maximum size that all queue files together will use on disk.\n<strong>$ActionQueueSaveOnShutdown on<\/strong>  # specifies that data should be saved at shutdown\n<strong>$ActionQueueType LinkedList<\/strong>  # holds enqueued messages in memory which makes the process very fast.&nbsp;\n<strong>$ActionResumeRetryCount -1<\/strong>  # prevents rsyslog from dropping messages when retrying to connect if server is not responding,<\/code><\/pre>\n\n\n\n<p>Restart the rsyslog service on the client.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl restart rsyslog<\/code><\/pre>\n\n\n\n<p>You can now log out of the client and login again. The authentication logs should be available on rsyslog server.<\/p>\n\n\n\n<p>Login to the Rsyslog server and verify the same.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ls \/var\/log\/remotelogs\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>127.0.0.1\/     192.168.57.35\/<\/code><\/pre>\n\n\n\n<p>In our case, we send only authentication logs to remote rsyslog server.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ls \/var\/log\/remotelogs\/192.168.57.35\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>CRON.log  sshd.log  sudo.log  su.log<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>tail -5 \/var\/log\/remotelogs\/192.168.57.35\/sshd.log <\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>2021-03-25T22:14:19+03:00 debian sshd&#91;590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.57.1  user=root\n2021-03-25T22:14:22+03:00 debian sshd&#91;590]: Failed password for root from 192.168.57.1 port 56714 ssh2<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Other Tutorials<\/h3>\n\n\n\n<p><a rel=\"noreferrer noopener\" class=\"rank-math-link\" href=\"https:\/\/kifarunix.com\/configure-rsyslog-on-solaris-11-4-to-send-logs-to-remote-log-server\/\" target=\"_blank\">Configure Rsyslog on Solaris 11.4 to Send logs to Remote Log Server<\/a><\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" class=\"rank-math-link\" href=\"https:\/\/kifarunix.com\/how-to-configure-syslog-to-send-logs-to-remote-syslog-server-on-solaris-11-4\/\" target=\"_blank\">Configure Syslog on Solaris 11.4 for Remote Logging<\/a><\/p>\n\n\n\n<p>Want to use NXLog to forward logs? Check out our article by following the link below;<\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" href=\"https:\/\/kifarunix.com\/configure-nxlog-to-forward-system-logs-to-rsyslog-server-on-ubuntu-18-04\/\" target=\"_blank\" class=\"rank-math-link\">Configure NXLog to Forward System Logs to Rsyslog Server on Ubuntu 20.04<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-configure-remote-logging-with-rsyslog-on-ubuntu-18-04\/\" target=\"_blank\" aria-label=\" (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">How to Configure Remote Logging with Rsyslog on Ubuntu 18.04<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to setup rsyslog server on Ubuntu 20.04. Rsyslog is a multi-threaded implementation of syslogd (a system utility providing<\/p>\n","protected":false},"author":1,"featured_media":8408,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[191,121,331],"tags":[3322,3317,3320,3324,3323,3319,3318,3321,3316,1200],"class_list":["post-8405","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-rsyslog","category-howtos","category-syslog","tag-allowedsender","tag-central-logging-with-rsyslog-on-ubuntu","tag-logging-server-ubuntu-20-04","tag-port-514-udp","tag-restrict-rsyslog-server","tag-rsyslog-server","tag-rsyslog-server-ubuntu-20-04","tag-rsyslog-conf","tag-setup-rsyslog-server-on-ubuntu-20-04","tag-ubuntu-20-04","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8405"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=8405"}],"version-history":[{"count":5,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8405\/revisions"}],"predecessor-version":[{"id":21885,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8405\/revisions\/21885"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/8408"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=8405"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=8405"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=8405"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}