# syslog-ng to central syslog server

## mcdelroy

Can someone who is successfully using syslog-ng to successfully log from on Linux box to another Linux box functioning as central log server please send me or post their a copy of their client and sever syslog-ng.confs? I don't want anything really fancy but I have been unable to get logging from one machine to another working at all. I am sure if I see a known config files I would be able to figure it out. That man page is not comprehensive.

thanks.

mcdelroy@yahoo.com

----------

## think4urs11

very simple actually

Server:

```
source network { udp(); };

destination messages { file("/var/log/messages"); };

log { source(network); destination(messages); }; 
```

Client:

```
destination syslog-server {udp("1.2.3.4 - IP syslogserver" port(514)); };
```

----------

## troymc

On the client set up a destination to your server. Then log to that destination.

```

destination loghost { udp(ip("$SERVER_IP")); };

log { source($SOURCE); destination(loghost); };

```

On the server setup something like this:

```

source remote { udp(ip("$LAN_IP"); };

destination remote_log { file("/var/log/$HOST"); };

log { source(remote); destination(remote_log); };

```

Note that the source $LAN_IP is the IP of the interface you want to listen on - so it's the server's IP - *NOT* the client's IP. You can also leave that empty [ie. upd() ] to listen on all interfaces.

Yes, I believe that the IPs do need to be quoted - although I've never tried it w/o quotes.

$HOST will automatically be expanded by syslog-ng.

troymc

----------

## mcdelroy

Awsome, that worked perfectly from a linux workstation to a linux server. Are there any special considerations for setting up a Cisco PIX to log to the same linux server? Thanks a bunch.

----------

## think4urs11

the mighty oracle says ... Pix and Syslog

----------

## mcdelroy

Is it possible to specify the sender IP on the recipeint syslog-ng server such that we can send messages from one client to one file and messages from another client to another file on the syslog-ng server?

----------

## troymc

 *mcdelroy wrote:*   

> Is it possible to specify the sender IP on the recipeint syslog-ng server such that we can send messages from one client to one file and messages from another client to another file on the syslog-ng server?

 

That is what the $HOST variable does in your syslog-ng.conf file.

```

destination remote_log { file("/var/log/$HOST"); };

```

It logs to a different file per host.

troymc

----------

## dejima

Interesting howto in http://hacks.oreilly.com/pub/h/1366

and a very good faq http://www.campin.net/syslog-ng/faq.html

----------

