How to Set Up Centralized Logging

Prerequisites

Before setting up centralized logging, make sure you have:

• At least two VPS servers (one as log server)
• Root or sudo privileges on all servers
• UDP port 514 open

Part 1: Configure Log Server (Central Collector)

Connect to your central log server:

ssh hxroot@LOG_SERVER_IP -p 22

Edit rsyslog configuration:

sudo nano /etc/rsyslog.conf

Uncomment or add:

module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")

Create separate log files per remote host:

sudo nano /etc/rsyslog.d/remote.conf

template(name="RemoteLogs" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?RemoteLogs

Restart rsyslog:

sudo systemctl restart rsyslog

Allow firewall:

sudo ufw allow 514/udp
sudo ufw allow 514/tcp

Part 2: Configure Client Servers

Connect to your client VPS:

ssh hxroot@CLIENT_VPS_IP -p 22

Edit rsyslog config:

sudo nano /etc/rsyslog.conf

Add at the end:

*.* @LOG_SERVER_IP:514

For TCP (more reliable):

*.* @@LOG_SERVER_IP:514

Restart rsyslog:

sudo systemctl restart rsyslog

Step 3: Test Log Forwarding

On client, generate a test log:

logger "Test log from $(hostname)"

On log server, check:

sudo ls /var/log/remote/

sudo tail -f /var/log/remote/CLIENT_HOSTNAME/syslog.log

Optional: Encrypt Logs with TLS

For secure transmission, use rsyslog over TLS (advanced).