Syslog Essentials: Forward Logs & Key Configurations

Syslog (rsyslog) is the backbone of Linux logging. Here’s what you actually need to know to forward logs and configure it properly.

1) Minimal Setup: Forward All Logs to a Remote Server

Edit /etc/rsyslog.d/10-forward.conf:

# Forward all logs to remote syslog server
*.* @@remote-host.example.com:514

Explanation:

  • *.* = all facilities and severities
  • @@ = TCP (use @ for UDP)
  • 514 = standard syslog port

Restart rsyslog:

sudo systemctl restart rsyslog

2) Useful Filters: Send Specific Logs

Forward only errors and higher severity:

*.err @@syslog-server:514

Forward only kernel messages:

kern.* @@syslog-server:514

Forward authentication logs separately:

auth,authpriv.* @@syslog-server:514

Forward application-specific logs:

if $programname == "nginx" then @@syslog-server:514
if $programname == "docker" then @@syslog-server:514

3) Most Useful Settings

Save logs to files with dates

$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

# Separate auth logs
auth,authpriv.* /var/log/auth.log

# Keep kernel logs separate
kern.* /var/log/kernel.log

# Debug logs (only if needed)
*.debug /var/log/debug.log

Discard spam (drop unwanted messages)

# Drop Docker noise
if $programname == "dockerd" and $msg contains "buildkit" then stop

# Drop repeated messages
$ActionExecOnlyOnce on

Add hostname prefix to forwarded logs

$ActionForwardDefaultTemplate RSYSLOG_FileFormat
*.* @@syslog-server:514

4) Real-World Example Config

Create /etc/rsyslog.d/20-production.conf:

# Forward all logs
*.* @@log-server.prod:514

# Keep auth logs locally too
auth,authpriv.* /var/log/auth.log

# Nginx errors only
if $programname == "nginx" and $severity <= 3 then @@log-server.prod:514

# Drop debug spam
if $severity == 7 then stop

# Discard these noisy apps
if $programname =~ "snapd|systemd-resolved" then stop

5) Verify It’s Working

Check local syslog queue:

tail -f /var/log/syslog

Monitor forwarding (test message):

logger "TEST: This is a test message from $(hostname)"
tail -f /var/log/syslog

Check rsyslog status:

sudo systemctl status rsyslog

6) Quick Reference: Severity Levels

0 = Emergency (system is unusable)
1 = Alert (action must be taken immediately)
2 = Critical
3 = Error
4 = Warning
5 = Notice
6 = Informational
7 = Debug

7) Common Gotchas

  • Firewall blocking: Ensure port 514 TCP/UDP is open
  • rsyslog not reloading: Use sudo systemctl restart rsyslog
  • Logs not forwarding: Check /var/log/syslog for errors
  • Remote server not receiving: Verify remote host has syslog listening on port 514

Pro tip: Use rsyslog-ng for complex setups鈥攊t’s more powerful. For simple forwarding, native rsyslog is perfect. 馃殌