# syslog-ng simple example

## donjames

Hi,

I am trying to set up syslog-ng to monitor another device on my LAN.

syslog-ng is at 192.168.1.38.

The other device is at 192.168.1.25.

Can someone tell me how to do this?

Thanks,

donjames

----------

## Banana

mybe this can help: https://github.com/balabit/syslog-ng-3.5/blob/master/debian/syslog-ng.conf.example

----------

## cboldt

```
# -------------------- Accept logging from remote clients ------------

source s_network        { network(transport("udp") port(514) keep-alive(yes)); };

destination d_clients   { file("/var/log/CLIENTS/$HOST"); };

# log { source(s_network); destination(d_clients); };

# -------------------- Submit logging to remote host -----------------

destination d_rlogger   { network("my-network.net" transport("udp") port(514) keep-alive(yes)); };

filter f_rlogger        { program("Rootkit|smartd|syslog-ng|tripwire|watch-logs"); };

log { source(src); filter(f_rlogger); destination(d_rlogger); };

```

Notice one of the two log lines is commented out.  This set of config is at a source machine.

Same code but moving comment hash is used at destination (remote logging) machine.

Example has filter at source.  Only a few programs are remote logged.

----------

## donjames

HI, cboldt

Three questions:

1.Where in the /etc/syslog-ng/syslog-ng.conf file do I put your suggested script?

2. Can I just put your script at the end of /etc/syslog-ng/syslog-ng.conf?

3. Can I create a file, /var/log/syslog-ng.log, and put this is place of /var/log/CLIENTS/$HOST?

Thanks,

donjames

 *cboldt wrote:*   

> 
> 
> ```
> # -------------------- Accept logging from remote clients ------------
> 
> ...

 Last edited by donjames on Sat Jun 13, 2020 3:12 pm; edited 1 time in total

----------

## nick_gentoo

 *donjames wrote:*   

> 
> 
> ```
> 
> destination d_clients   { file("/var/log/syslog-ng.log); };
> ...

 

Hi! That line is missing a quote at the end of the file path.

----------

## donjames

Hi nick_gentoo,

Thanks.  That fixes one of my problems.

I am trying to troubleshoot a linksys ATA that is connected to the same LAN as my gentoo box. Its ip address is 192.168.1.25.  The gentoo box is at 192.168.1.38.  

I have set up the ATA to send log messages to the gentoo box at 192.168.1.38.

Will the syslog-ng default setup allow me to do this?

Thanks,

donjames

 *nick_gentoo wrote:*   

>  *donjames wrote:*   
> 
> ```
> 
> destination d_clients   { file("/var/log/syslog-ng.log); };
> ...

 

----------

## pietinger

 *donjames wrote:*   

> I am trying to troubleshoot a linksys ATA that is connected to the same LAN as my gentoo box. Its ip address is 192.168.1.25.  The gentoo box is at 192.168.1.38.  
> 
> I have set up the ATA to send log messages to the gentoo box at 192.168.1.38.
> 
> Will the syslog-ng default setup allow me to do this?

 

I havent tried, but it should be possible with the "smartd" from smartmontools, because you can set up a log facility. From "man smartd":

```
       -l FACILITY, --logfacility=FACILITY

              Uses  syslog  facility  FACILITY to log the messages from smartd.  Here FACILITY is one of local0, local1, ..., local7, or daemon [default].  If this command-line option is not used, then by default messages from smartd are logged to

              the facility daemon.

              If you would like to have smartd messages logged somewhere other than the default location, include (for example) '-l local3' in its start up argument list.  Tell the syslog daemon to log all messages from facility local3 to (for ex‐

              ample) '/var/log/smartd.log'.

              For more detailed information, please refer to the man pages for the local syslog daemon, typically syslogd(8), syslog-ng(8) or rsyslogd(8)
```

----------

## cboldt

Location of the code snippet doesn't matter.  It's self-contained.  I put all my "custom" stuff in /etc/syslog-ng/syslog-local.conf, and have this line in /etc/syslog-ng/syslog-ng.conf:

```
@include "syslog-local.conf"
```

I personally put the remote logging material at the top of my  /etc/syslog-ng/syslog-local.conf file, but it could just as well be at the bootom of that, or at the top of /etc/syslog-ng/syslog-ng.conf, or bottom of that file, or pretty much anyplace in the middle if you prefer.

No need to create the log file or files.  syslog-ng will create what you specify in 'destination'  I wanted a different file for each of the several machines that push material, and used /var/log/CLIENTS as a directory for all logging from remote machines.  Nothing magic about this, choose whatever destination suits you.

----------

