Install Rsyslog on Ubuntu 20.04

 

Install Rsyslog on Ubuntu 20.04

Rsyslog is the default syslogd on Debian systems and is usually installed on Ubuntu 20.04 by default.

You can verify this by checking the version of installed rsyslog.

apt list -a rsyslog

 

root@SaadAtaullah:~# apt list -a rsyslog Listing... Done rsyslog/focal-updates,now 8.2001.0-1ubuntu1.1 amd64 [installed,automatic] rsyslog/focal 8.2001.0-1ubuntu1 amd64

                 If for any reasons it is not installed, run the command below to install it.

 

apt update

apt install rsyslog -y

Once the installation is done, start and enable the rsyslog service.

systemctl enable --now rsyslog

 

NOW

Setup Rsyslog Server on Ubuntu 20.04

Now that rsyslog is installed and running, you need to configure it to run in server mode. As stated above, rsyslog can be configured as client to sent logs to a central logging server or a server to receive and store logs from other systems.

In this guide, we setup Rsyslog as a server on an Ubuntu 20.04 box.

Open the ryslog configuration file for editing;

Nano /etc/rsyslog.conf

Define Rsyslog Server Protocol and Port

To begin with, define the protocol and port you want to receive logs on.

You can choose to use UDP or TCP and any port of your choice.

By default UDP syslog is received on port 514.

 

Enable UDP syslog reception:

 

Within the /etc/rsyslog.conf configuration file, uncomment the lines for UDP syslog reception in the MODULES section as shown below;

 

#################

#### MODULES ####

#################

# provides UDP syslog reception

module(load="imudp")

input(type="imudp" port="514")

 

# provides TCP syslog reception

#module(load="imtcp")

#input(type="imtcp" port="514")

 

Now we enable syslog in librenms

https://docs.librenms.org/Extensions/Syslog/

nano  /etc/rsyslog.d/libre.conf

copy paste below script

# Feed syslog messages to librenms

module(load="omprog")

 

template(name="librenms"

        type="string"

        string= "%FROMHOST-ip%||%syslogfacility%||%syslogpriority%||%syslogseverity%||%syslogtag%||%$year%-%$month%-%$day% %timegenerated:8:25%||%msg%||%programname%\n")

        action(type="omprog"

        binary="/opt/librenms/syslog.php"

        template="librenms")

 

& stop

 

Add the following to your LibreNMS under nano /opt/librenms/config.php file to enable the Syslog extension:

$config['enable_syslog'] = 1;

Syslog Clean Up

Can be set inside of config.php

$config['syslog_purge'] = 30;

 

Let troubleshoot rsyslog

sudo netstat -taupn | grep syslog 

nano /var/log/syslog

for more settings to enable email settings see my video on youtube

https://youtu.be/J7ZBs2ut-Ho

Gmail SMTP setup settings:

• SMTP username: Your Gmail address
• SMTP password: Your Gmail password
• SMTP server address: smtp.gmail.com
• Gmail SMTP port (TLS): 587
• SMTP port (SSL): 465
• SMTP TLS/SSL required: yes