{"id":3094,"date":"2020-05-07T17:19:42","date_gmt":"2020-05-07T11:49:42","guid":{"rendered":"https:\/\/www.24x7serversupport.com\/blog\/?p=3094"},"modified":"2023-01-28T12:53:15","modified_gmt":"2023-01-28T07:23:15","slug":"how-to-configure-rsyslog-in-centos-rhel-7-server","status":"publish","type":"post","link":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/","title":{"rendered":"How to Configure Rsyslog in CentOS\/RHEL 7 Server"},"content":{"rendered":"\n<p>By default, <strong>Rsyslog<\/strong> service is automatically installed and should be running in <strong>CentOS\/RHEL 7<\/strong>. In order to check if the daemon is started in the system, issue the following command with root privileges.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># systemctl status rsyslog.service\n<\/pre>\n\n\n\n<p><a href=\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2017\/09\/Check-Rsyslog-Service.png\"><\/a><\/p>\n\n\n\n<p>Check Rsyslog Service<\/p>\n\n\n\n<p>If the service is not running by default, execute the below command in order to start rsyslog daemon.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># systemctl start rsyslog.service\n<\/pre>\n\n\n\n<p><strong>2.<\/strong> If the rsyslog package is not installed on the system that you intend to use as a centralized logging server, issue the following command to install the rsyslog package.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># yum install rsyslog\n<\/pre>\n\n\n\n<p><strong>3.<\/strong> The first step that we need to do on the system in order to configure rsyslog daemon as a centralized log server, so it can receive log messages for external clients, is to open and edit, using your favorite text editor, the main configuration file from <strong>\/etc\/rsyslog.conf<\/strong>, as presented in the below excerpt.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># vi \/etc\/rsyslog.conf\n<\/pre>\n\n\n\n<p>In the rsyslog main configuration file, search and uncomment the following lines (remove the hashtag&nbsp;<code>#<\/code>&nbsp;sign at the line beginning) in order to provide UDP transport reception to Rsyslog server via <strong>514<\/strong> port. UDP is the standard protocol used for log transmission by Rsyslog.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ModLoad imudp \n$UDPServerRun 514\n<\/pre>\n\n\n\n<p><a href=\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2017\/09\/Configure-Rsyslog-Server.png\"><\/a><\/p>\n\n\n\n<p>Configure Rsyslog Server<\/p>\n\n\n\n<p><strong>4.<\/strong> UDP protocol does not have the TCP overhead, which make it faster for transmitting data than TCP protocol. On the other hand, UDP protocol does not assure reliability of transmitted data.<\/p>\n\n\n\n<p>However, if you need to use TCP protocol for log reception you must search and uncomment the following lines from <strong>\/etc\/rsyslog.conf<\/strong> file in order to configure Rsyslog daemon to bind and listen a TCP socket on 514 port. TCP and UDP listening sockets for reception can be configured on a Rsyslog server simultaneously.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ModLoad imtcp \n$InputTCPServerRun 514 \n<\/pre>\n\n\n\n<p><strong>5.<\/strong> On the next step, don\u2019t close the file yet, create a new template that will be used for receiving remote messages. This template will instruct the local Rsyslog server where to save the received messages send by syslog network clients. The template must be added before the beginning of the <strong>GLOBAL DIRECTIVES<\/strong> block as illustrated in the below excerpt.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$template RemoteLogs,\"\/var\/log\/%HOSTNAME%\/%PROGRAMNAME%.log\"&nbsp;\n.&nbsp;?RemoteLogs &amp; ~\n<\/pre>\n\n\n\n<p><a href=\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2017\/09\/Create-Rsyslog-Template.jpg\"><\/a><\/p>\n\n\n\n<p>Create Rsyslog Template<\/p>\n\n\n\n<p>The&nbsp;above <strong>$template&nbsp;RemoteLogs<\/strong>&nbsp;directive instructs Rsyslog daemon to collect and write all of the received log messages to distinct files, based on the client machine name and remote client facility (application) that generated the messages based on the defined properties presents in the template configuration: <strong>%HOSTNAME%<\/strong> and <strong>%PROGRAMNAME%<\/strong>.<\/p>\n\n\n\n<p>All these log files will be written to local filesystem to a dedicated file named after client machine\u2019s hostname and stored in \/var\/log\/ directory.<\/p>\n\n\n\n<p>The&nbsp;<strong>&amp; ~<\/strong> redirect rule instructs the local Rsyslog server to stop processing the received log message further and discard the messages (not write them to internal log files).<\/p>\n\n\n\n<p>The <strong>RemoteLogs<\/strong> name is an arbitrary name given to this template directive. You can use whatever name you can find best suited for your template.<\/p>\n\n\n\n<p>In order to write all received messages from clients in a single log file named after the IP Address of the remote client, without filtering the facility that generated the message, use the below excerpt.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$template FromIp,\"\/var\/log\/%FROMHOST-IP%.log\"&nbsp;\n.&nbsp;?FromIp &amp; ~ \n<\/pre>\n\n\n\n<p>Another example of a template where all messages with auth facility flag will be logged to a template named \u201c<strong>TmplAuth<\/strong>\u201c.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$template TmplAuth, \"\/var\/log\/%HOSTNAME%\/%PROGRAMNAME%.log\" \nauthpriv.*   ?TmplAuth\n<\/pre>\n\n\n\n<p>Below is an excerpt form a template definition from Rsyslog 7 server:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">template(name=\"TmplMsg\" type=\"string\"\n         string=\"\/var\/log\/remote\/msg\/%HOSTNAME%\/%PROGRAMNAME:::secpath-replace%.log\"\n        )\n<\/pre>\n\n\n\n<p>The above template excerpt can also be written as:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">template(name=\"TmplMsg\" type=\"list\") {\n    constant(value=\"\/var\/log\/remote\/msg\/\")\n    property(name=\"hostname\")\n    constant(value=\"\/\")\n    property(name=\"programname\" SecurePath=\"replace\")\n    constant(value=\".log\")\n    }\n<\/pre>\n\n\n\n<p><strong>6.<\/strong> After you\u2019ve edited the Rsyslog configuration file with your own settings as explained above, restart the Rsyslog daemon in order to apply changes by issuing the following command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># service rsyslog restart\n<\/pre>\n\n\n\n<p><strong>7.<\/strong> By now, Rsyslog server should be configured to act a centralized log server and record messages from syslog clients. To verify Rsyslog network sockets, run netstat command with root privileges and use grep to filter rsyslog&nbsp;string.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># netstat -tulpn | grep rsyslog \n<\/pre>\n\n\n\n<p><a href=\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2017\/09\/Verify-Rsyslog-Network-Socket.png\"><\/a><\/p>\n\n\n\n<p>Verify Rsyslog Network Socket<\/p>\n\n\n\n<p><strong>8.<\/strong> If you have SELinux enabled in <strong>CentOS\/RHEL 7<\/strong>, issue the following command to configure SELinux to allow rsyslog traffic depending on network socket type.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># semanage -a -t syslogd_port_t -p udp 514\n# semanage -a -t syslogd_port_t -p tcp 514 \n<\/pre>\n\n\n\n<p><strong>9.<\/strong> If the firewall is enabled and active, run the below command in order to add the necessary rules for opening rsyslog ports in Firewalld.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># firewall-cmd --permanent --add-port=514\/tcp\n# firewall-cmd --permanent --add-port=514\/udp\n# firewall-cmd \u2013reload\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>By default, Rsyslog service is automatically installed and should be running in CentOS\/RHEL 7. In order to check if the daemon is started in the system, issue the following command with root privileges. # systemctl status rsyslog.service Check Rsyslog Service If the service is not running by default, execute the below command in order to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":3613,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[30,33],"tags":[31,114,307],"class_list":["post-3094","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-centos","category-cpanel","tag-centos","tag-centos-7","tag-rsyslog"],"jetpack_publicize_connections":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Configure Rsyslog in CentOS\/RHEL 7 Server | 24x7serversupport Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Configure Rsyslog in CentOS\/RHEL 7 Server | 24x7serversupport Blog\" \/>\n<meta property=\"og:description\" content=\"By default, Rsyslog service is automatically installed and should be running in CentOS\/RHEL 7. In order to check if the daemon is started in the system, issue the following command with root privileges. # systemctl status rsyslog.service Check Rsyslog Service If the service is not running by default, execute the below command in order to [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/\" \/>\n<meta property=\"og:site_name\" content=\"24x7serversupport Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-07T11:49:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-28T07:23:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png\" \/>\n\t<meta property=\"og:image:width\" content=\"720\" \/>\n\t<meta property=\"og:image:height\" content=\"340\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"24x7support\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@24x7serversuppo\" \/>\n<meta name=\"twitter:site\" content=\"@24x7serversuppo\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"24x7support\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/\",\"url\":\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/\",\"name\":\"How to Configure Rsyslog in CentOS\/RHEL 7 Server | 24x7serversupport Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/i0.wp.com\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png?fit=720%2C340&ssl=1\",\"datePublished\":\"2020-05-07T11:49:42+00:00\",\"dateModified\":\"2023-01-28T07:23:15+00:00\",\"author\":{\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/#\/schema\/person\/decfb5fad6bde6ac6822d4e965c6d401\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#primaryimage\",\"url\":\"https:\/\/i0.wp.com\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png?fit=720%2C340&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png?fit=720%2C340&ssl=1\",\"width\":720,\"height\":340,\"caption\":\"How to Configure Rsyslog in CentOS\/RHEL 7 Server\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.24x7serversupport.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Configure Rsyslog in CentOS\/RHEL 7 Server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/#website\",\"url\":\"https:\/\/www.24x7serversupport.com\/blog\/\",\"name\":\"24x7serversupport Blog\",\"description\":\"Linux | CPanel | WHM | webhosting| Plesk | DirectAdmin | CentOs | Debian | Ubuntu Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.24x7serversupport.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.24x7serversupport.com\/blog\/#\/schema\/person\/decfb5fad6bde6ac6822d4e965c6d401\",\"name\":\"24x7support\",\"url\":\"https:\/\/www.24x7serversupport.com\/blog\/author\/24x7support\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Configure Rsyslog in CentOS\/RHEL 7 Server | 24x7serversupport Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/","og_locale":"en_US","og_type":"article","og_title":"How to Configure Rsyslog in CentOS\/RHEL 7 Server | 24x7serversupport Blog","og_description":"By default, Rsyslog service is automatically installed and should be running in CentOS\/RHEL 7. In order to check if the daemon is started in the system, issue the following command with root privileges. # systemctl status rsyslog.service Check Rsyslog Service If the service is not running by default, execute the below command in order to [&hellip;]","og_url":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/","og_site_name":"24x7serversupport Blog","article_published_time":"2020-05-07T11:49:42+00:00","article_modified_time":"2023-01-28T07:23:15+00:00","og_image":[{"width":720,"height":340,"url":"https:\/\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png","type":"image\/png"}],"author":"24x7support","twitter_card":"summary_large_image","twitter_creator":"@24x7serversuppo","twitter_site":"@24x7serversuppo","twitter_misc":{"Written by":"24x7support","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/","url":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/","name":"How to Configure Rsyslog in CentOS\/RHEL 7 Server | 24x7serversupport Blog","isPartOf":{"@id":"https:\/\/www.24x7serversupport.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#primaryimage"},"image":{"@id":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png?fit=720%2C340&ssl=1","datePublished":"2020-05-07T11:49:42+00:00","dateModified":"2023-01-28T07:23:15+00:00","author":{"@id":"https:\/\/www.24x7serversupport.com\/blog\/#\/schema\/person\/decfb5fad6bde6ac6822d4e965c6d401"},"breadcrumb":{"@id":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#primaryimage","url":"https:\/\/i0.wp.com\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png?fit=720%2C340&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png?fit=720%2C340&ssl=1","width":720,"height":340,"caption":"How to Configure Rsyslog in CentOS\/RHEL 7 Server"},{"@type":"BreadcrumbList","@id":"https:\/\/www.24x7serversupport.com\/blog\/how-to-configure-rsyslog-in-centos-rhel-7-server\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.24x7serversupport.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Configure Rsyslog in CentOS\/RHEL 7 Server"}]},{"@type":"WebSite","@id":"https:\/\/www.24x7serversupport.com\/blog\/#website","url":"https:\/\/www.24x7serversupport.com\/blog\/","name":"24x7serversupport Blog","description":"Linux | CPanel | WHM | webhosting| Plesk | DirectAdmin | CentOs | Debian | Ubuntu Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.24x7serversupport.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.24x7serversupport.com\/blog\/#\/schema\/person\/decfb5fad6bde6ac6822d4e965c6d401","name":"24x7support","url":"https:\/\/www.24x7serversupport.com\/blog\/author\/24x7support\/"}]}},"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.24x7serversupport.com\/blog\/wp-content\/uploads\/2020\/05\/Setup-Rsyslog-Client-in-CentOS-7.png?fit=720%2C340&ssl=1","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/posts\/3094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/comments?post=3094"}],"version-history":[{"count":2,"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/posts\/3094\/revisions"}],"predecessor-version":[{"id":3346,"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/posts\/3094\/revisions\/3346"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/media\/3613"}],"wp:attachment":[{"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/media?parent=3094"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/categories?post=3094"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.24x7serversupport.com\/blog\/wp-json\/wp\/v2\/tags?post=3094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}