Syslog Server Configuration - Complete Guide
1. What is a Syslog Server?
Definition: A Syslog server is a centralized logging solution that receives, stores, and manages log messages sent by network devices and systems using the Syslog protocol.
Why Use It?
- ✅ Centralized logging – Aggregate all logs in one location.
- ✅ Real-time monitoring – Detect problems as they occur.
- ✅ Compliance – Store logs for auditing and legal requirements.
- ✅ Filtering & Alerts – Focus only on important events.
2. Syslog Protocol Basics
- Transport: UDP 514 (default), TCP 514 (for reliability)
- Message Format:
<PRI>Timestamp Hostname Facility.Severity: Message
<134>Dec 15 10:30:45 Router1 %SYS-3-CRITICAL: Temperature threshold exceeded3. Installing a Syslog Server
Linux (rsyslog)
sudo apt install rsyslog
sudo systemctl enable rsyslogWindows
- Kiwi Syslog Server (Free or Paid)
- SolarWinds Syslog Server (Enterprise-grade)
macOS
brew install rsyslog4. Configuring Syslog Server
A. Enable UDP/TCP Listening (Linux)
Edit/etc/rsyslog.conf:
# Enable UDP
module(load="imudp")
input(type="imudp" port="514")
# Enable TCP (optional)
module(load="imtcp")
input(type="imtcp" port="514")sudo systemctl restart rsyslogB. Define Log Storage & Retention
# Store logs per host in /var/log/remote/
$template RemoteLogs,"/var/log/remote/%HOSTNAME%.log"
*.* ?RemoteLogssudo nano /etc/logrotate.d/rsyslogC. Filter Logs by Severity
# Only store critical logs (levels 0–2)
if $syslogseverity <= 2 then /var/log/critical.log5. Configuring Network Devices
Cisco Router/Switch:
Router(config)# logging host 192.168.1.100
Router(config)# logging trap warnings
Router(config)# logging source-interface Gig0/0Linux Client:
sudo nano /etc/rsyslog.conf
*.* @192.168.1.100:514Windows:
Use Event Viewer → Subscriptions to forward events.
6. Verifying Syslog Communication
On Syslog Server:
tail -f /var/log/remote/Router1.logOn Cisco Device:
show logging | include sendingTest from Linux Client:
logger -p local3.err "Test message from Linux"7. Securing Syslog
Firewall Rules:
sudo ufw allow from 192.168.1.0/24 to any port 514 proto udpEnable TLS (TCP Only):
# In /etc/rsyslog.conf
module(load="gtls")
input(type="imtcp" port="6514" StreamDriver.Name="gtls")8. Centralized Log Management Tools
| Tool | Purpose |
|---|---|
| Graylog | Open-source log analysis and dashboards |
| Splunk | Paid enterprise SIEM & analytics |
| ELK Stack | Elasticsearch + Logstash + Kibana |
Graylog Example Flow: Syslog input → Apply rules → Trigger alerts
9. Time Sync (NTP)
Correct timestamps are essential in log correlation.
Linux:
sudo apt install chrony
sudo systemctl enable chronyCisco:
Router(config)# ntp server pool.ntp.org10. Monitoring & Alerts
Linux Email Alert:
grep -i "CRITICAL" /var/log/remote/Router1.log | mail -s "ALERT" admin@example.comEnterprise Tools:
- SolarWinds: Alerts on messages like
%LINK-3-UPDOWN - PRTG: Monitors syslog for threshold triggers (e.g., high CPU)
11. Troubleshooting
| Issue | Solution |
|---|---|
| No logs received | Check firewall, UDP 514, device config |
| Wrong timestamps | Sync time with NTP |
| Logs truncated | Use TCP or increase buffer size |
Packet Capture:
sudo tcpdump -i eth0 udp port 514 -vv12. Summary
- Install rsyslog/Kiwi/Graylog depending on OS
- Configure listening ports and log storage
- Forward logs from routers/switches/servers
- Apply severity-based filters
- Secure the setup with firewalls and encryption
- Use alerts and dashboards for critical events