{"id":1992,"date":"2023-12-18T07:03:42","date_gmt":"2024-02-02T07:13:58","guid":{"rendered":""},"modified":"2025-02-02T00:46:17","modified_gmt":"2025-02-01T23:46:17","slug":"how-to-install-and-configure-rsyslog-server-and-client-on-ubuntu-24-04","status":"publish","type":"post","link":"https:\/\/netcloud24.com\/knowledgebase\/how-to-install-and-configure-rsyslog-server-and-client-on-ubuntu-24-04\/","title":{"rendered":"Linux VPS & VPS Windows Setup Guide | NetCloud24 and Configure Rsyslog Server and Client on Ubuntu 24.04"},"content":{"rendered":"

\u00a0<\/p>\n<\/p>\n

\n

\u00a0<\/h1>\n<\/header>\n
\n

Rsyslog<\/strong> is a powerful and flexible logging utility for forwarding log messages across systems. It can be used to centralize logs from multiple servers into a single location, making it easier to monitor, analyze, and troubleshoot. In this guide, we will walk you through how to install and configure both an Rsyslog server and client on Ubuntu 24.04. This setup is ideal for managing logs on VPS servers<\/strong> or any network environment.<\/p>\n

Step 1: Update Your System<\/h2>\n

Before starting, ensure your Ubuntu 24.04 system is up to date. Open a terminal and run the following commands:<\/p>\n

sudo apt update && sudo apt upgrade -y<\/code><\/pre>\n
Step 2: Install Rsyslog<\/h2>\n
Rsyslog is typically installed by default on most Linux distributions, but if it’s not, you can install it using the following command:<\/p>\n
sudo apt install rsyslog -y<\/code><\/pre>\n
After installation, start and enable the Rsyslog service to ensure it runs at boot:<\/p>\n
\r\nsudo systemctl start rsyslog\r\nsudo systemctl enable rsyslog\r\n        <\/code><\/pre>\n
Step 3: Configure Rsyslog as a Server<\/h2>\n
To set up your server to receive logs from other clients, you need to modify the Rsyslog configuration file. Open the Rsyslog configuration file for editing:<\/p>\n
sudo nano \/etc\/rsyslog.conf<\/code><\/pre>\n
Uncomment the following lines to enable UDP and TCP reception of log messages:<\/p>\n
\r\n# Provides UDP syslog reception\r\nmodule(load=\"imudp\")\r\ninput(type=\"imudp\" port=\"514\")\r\n\r\n# Provides TCP syslog reception\r\nmodule(load=\"imtcp\")\r\ninput(type=\"imtcp\" port=\"514\")\r\n        <\/code><\/pre>\n
Save and exit the file, then restart Rsyslog to apply the changes:<\/p>\n
sudo systemctl restart rsyslog<\/code><\/pre>\n
Step 4: Configure Rsyslog on the Client<\/h2>\n
On the client machine, Rsyslog must be configured to forward logs to the Rsyslog server. First, open the Rsyslog configuration file on the client:<\/p>\n
sudo nano \/etc\/rsyslog.conf<\/code><\/pre>\n
Add the following line at the bottom of the file to send logs to the server via UDP (replace server_ip<\/code> with the actual IP address of your Rsyslog server):<\/p>\n
*.* @server_ip:514<\/code><\/pre>\n
If you prefer to send logs via TCP, use this line instead:<\/p>\n
*.* @@server_ip:514<\/code><\/pre>\n
Save and exit the file, then restart Rsyslog on the client:<\/p>\n
sudo systemctl restart rsyslog<\/code><\/pre>\n
Step 5: Verify the Configuration<\/h2>\n
To verify that the client is successfully sending logs to the server, check the server\u2019s log files. Logs from the client should appear in the default log directory, typically located at \/var\/log<\/code>.<\/p>\n
On the server, you can check if logs are being received by monitoring the syslog file:<\/p>\n
sudo tail -f \/var\/log\/syslog<\/code><\/pre>\n
If logs from the client are appearing in the server’s syslog, the configuration is working correctly.<\/p>\n
Step 6: Securing the Rsyslog Server<\/h2>\n
Since Rsyslog is transmitting logs across the network, it is recommended to secure the connection using TLS encryption. This step is optional but highly recommended, especially for VPS servers<\/strong> that handle sensitive information.<\/p>\n
Install TLS Certificates<\/h3>\n
First, generate or obtain a TLS certificate and key pair for the Rsyslog server. You can use Let’s Encrypt or any other certificate authority.<\/p>\n
Once you have the certificates, configure Rsyslog to use TLS. Open the Rsyslog configuration file and add the following lines:<\/p>\n
\r\n# Enable TLS\r\n$DefaultNetstreamDriverCAFile \/etc\/ssl\/certs\/ca-certificates.crt\r\n$DefaultNetstreamDriverCertFile \/etc\/ssl\/certs\/your_certificate.pem\r\n$DefaultNetstreamDriverKeyFile \/etc\/ssl\/private\/your_private_key.key\r\n$ActionSendStreamDriver gtls # use gtls netstream driver\r\n$ActionSendStreamDriverMode 1 # require TLS\r\n$ActionSendStreamDriverAuthMode anon\r\n        <\/code><\/pre>\n
After saving the configuration, restart Rsyslog on both the server and client to apply the changes:<\/p>\n
sudo systemctl restart rsyslog<\/code><\/pre>\n
Step 7: Monitoring Logs on a VPS Server<\/h2>\n
If you’re running multiple VPS servers<\/strong>, centralizing your logs with Rsyslog allows for easier log monitoring and troubleshooting. By sending logs from all your VPS instances to a single Rsyslog server, you can efficiently monitor server activity, detect issues, and maintain system health from a central point.<\/p>\n
Looking for a Reliable VPS Solution?<\/h2>\n
For those managing logs across multiple servers, a reliable and scalable VPS server<\/strong> is essential. If you’re looking for high-performance VPS hosting, consider . With Windows VPS<\/strong>, you get full control over your server environment, making it ideal for centralizing logs and managing server infrastructure efficiently.<\/p>\n