Configuring rsyslog for centralized logging

Centralized logging using the central-rsyslog server can be set up after you’ve updated to the most recent version of rsyslog.

The central logging setup is created by turning on the rsyslog UDP input module, imudp, and building the rsyslog template to receive log messages from other servers. The imudp input module allows syslog messages to be broadcast over UDP to be received by the central-rsyslog server.

Enable the options shown in the following screenshot in /etc/rsyslog.conf (the rsyslog configuration file) before saving the file and closing the editor.

The imudp input module needs to be configured to utilize the default UDP port of 514 to work:

Figure 11.3 – imudp module configuration

Then, create a new rsyslog template (/etc/rsyslog.d/50-remote-logs.conf) and paste the configuration indicated in Figure 11.4.

The following rsyslog template will allow you to collect logs from other...