Setting up syslog server and syslog-ng clients

Background

perfSONAR machines must be setup so that they send logs to a central server.

The process to do is given below:

Step 1. Setup a syslog-ng client

This needs to be setup on a perfSONAR machine. For this we need to make a few changes to the "syslog-ng.conf" placed inside "/etc/syslog-ng/".

..
options {
  ..
  use_fqdn(yes);
  ..
  ..
};

..

# define local source for logging
source local {
  unix-dgram("/var/run/log");
  udp(ip(127.0.0.1) port(514));
  internal();
};

..

# define destination loghost
destination loghost {
  tcp("10.0.0.13" port(514));
};

..

# define a filter
filter notdebug {
  level(info...emerg);
};

..

# now define the log
log {
  source(local);
  filter(notdebug);
  destination(loghost);
};

..

Sample syslog-ng.conf file attached.

Step 2. Setup a syslog server

This part is easy. Just make the following change in "/etc/sysconfig/syslog".

From:

SYSLOGD_OPTIONS="-m 0"

to:

SYSLOGD_OPTIONS="-m 0 -r -x"

This change to the syslog daemon enables logging from remote machines and disables DNS lookups on incoming syslog messages.