Step 1:
Access http://[your-graylog-server]:[portNumber]/system/inputs to obtain this info such as show in this example:
Syslog_UDP Syslog UDP 1 RUNNING
allow_override_date: true
bind_address: 10.10.10.100
expand_structured_data: false
force_rdns: false
number_worker_threads: 4
override_source: <empty>
port: 514
recv_buffer_size: 1048576
store_full_message: false
Step 2:
Configure the Linux client (CentOS 8 is used in this illustration)
# Check whether rsyslog exists and is running:
[root@linuxbox ~]# systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2018-12-16 23:49:45 PST; 17h ago
Docs: man:rsyslogd(8)
Main PID: 1230 (rsyslogd)
Tasks: 3 (limit: 48547)
Memory: 100.6M
CGroup: /system.slice/rsyslog.service
└─1230 /usr/sbin/rsyslogd -n
# Configure syslog:
# Check whether there are existing configs
[root@linuxbox ~]# ls /etc/rsyslog.d
# empty output would mean that there're no existing configurations
# Add a config file
graylogServer=your-graylog-server
port=514 # this port is default and may not be correct unless verified
protocol=udp # access http://your-graylog-server:9000/system/inputs to obtain this info
configFile=/etc/rsyslog.d/greylog.conf
if [$protocol == udp]
then
prefix=@
else
prefix=@@
fi
echo "*.* $prefix$graylogServer:$port;RSYSLOG_SyslogProtocol23Format"
cat << EOF > $configFile
*.* $prefix$graylogServer:$port;RSYSLOG_SyslogProtocol23Format
EOF
cat $configFile
# Restart rsyslog to realize changes
systemctl restart rsyslog
Categories:
