syslog-ng loghost

[Patrick M. Hausen]

I see. So caveats aside - our conversation started, because I pointed out that with "ip(127.0.0.1)" in your config, the syslog server will not be reachable from the outside. That still stands. You probably need to change that to "ip(0.0.0.0)" if I read the syslog-ng docs correctly.

After restarting the syslog daemon you can check with

Code Select Expand

netstat -na | grep 514
if it is still listening on "127.0.0.1.514" only or if that changed to "*.514" as necessary to send log data to this host.

HTH,
Patrick

[Fright]

@mbr89

Without ip("127.0.0.1")It is not showing up in netstat

hm.

Code Select Expand

syslog( transport("udp") max-connections(8) );
is tested and working source config line ("UDP source with defaults.")
(https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.33/administration-guide/26#TOPIC-1663252)

[sanxiago]

You can enable remote logging on syslog-ng like this:

create a file /usr/local/etc/syslog-ng.conf.d/remote.conf with this:

Code Select Expand


source s_network {
    network(
        ip("192.168.1.1")
        transport("udp")
    );
};

destination d_syslog {
file("/var/log/syslog-ng/messages_${HOST}"); };

log { source(s_network); destination(d_syslog); };


# Create the directory
mkdir /var/log/syslog-ng

Stop syslog-ng
pkill -f /usr/local/sbin/syslog-ng

Start syslog-ng
/usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf -p /var/run/syslog-ng.pid

If you have a malicious client it can hammer your drive, and too much activity will bog you down.