Linux configuration

When configuring Rsyslog for CentOS and Red Hat 5 and 6, be sure the fully qualified domain name (FQDN) of the Comm Broker is registered in DNS, and the server can resolve the name correctly.

1. Open /etc/rsyslog.conf for editing.

2. Add the following lines to the body of the file:

   Note

   In this script @ implies UDP is used, and @@ will use TCP.

   # ### begin forwarding rule ###
   # These messages will log to the Communications Broker Auth.info 
   @CommBroker.company.com:514 Authpriv.info 
   @CommBroker.company.com:514 Cron.* 
   @CommBroker.company.com:514 Daemon.crit 
   @CommBroker.company.com:514 Kern.crit 
   @CommBroker.company.com:514
   Uncomment the following lines to cache logs on hard disk:
   $WorkDirectory /var/lib/rsyslog
   $ActionQueueFileName fwdRule1
   $ActionQueueMaxDiskSpace 1g
   $ActionQueueuSaveOnShutdown on
   $ActionQueueType LinkedList
   $ActionResumeRetryCount -1
   *.*@CommBroker.company.com:514 
   #this final line specifies the forwarding location

3. Ensure rsyslog runs at boot:

   chkconfig rsyslog on

4. Restart the service:

   service rsyslog restart

1. Open /etc/syslog-ng/syslog-ng.conf for editing.

2. Define a new destination:

   destination d_commbroker {syslog ("10.1.1.1"transport("udp")port(514));};

   Replace "10.1.1.1" with the IP address of the Comm Broker.

3. Add this destination to the appropriate log definition:

   log {
   source(s_network); 
   # example existing log source source(s_bro_conn); 
   # example existing log source destination(d_commbroker);
   }

4. Restart the service:

   service syslog-ng restart