[rsyslog][Server] How to use rsyslog and receive log from remote machine

[rsyslog] How to use rsyslog and receive log from remote machine

1. vi /etc/rsyslog.conf



# Provide UDP syslog reception

$ModLoad imudp

$UDPServerRun 512  # Can change port to 514



2. Restart rsyslog

sudo service rsyslog restart


Check 512 port open or not
Command :

netstat -uln



3. see where is file to save ( all message are save in /var/log/messages )

see /etc/rsyslog.d/50-default.conf



4. Send message to Remote Server

Ref [1] 

nc -w0 -u 192.168.1.200 512 <<< "happy"

Reference :

1. 
   Syslog: Sending log from remote servers to syslog daemon


2. 
   活用rsyslog結合MySQL 實現日誌集中控管


3. 
   Getting arbitrary log files into Rsyslog