Configuring remote logging is an RHCE objective and the following items are covered in this article.  The rsyslog service is installed and turned on by default in Red Hat Enterprise Linux 6.  The instructions in this article require that commands be executed as the root user.

I’ve also added instructions on how to send logs to the remote server and to your local system.

• Configure a system to log to a remote system.
• Configure a system to accept logging from a remote system

Configure a System to Accept Logging From a Remote System

1. You will need to start by editing the host machine to accept logging by editing the /etc/rsyslog.conf file and enabling the server to accept logging.  This can be done using the directions below.
   First edit the /etc/rsyslog.conf file using your favorite text editor and uncommenting the section containing the protocol you will use for your server.  In the example below the TCP protocol will be used.Example: nano /etc/rsyslog.conf

   
   

2. Restart the rsyslog service to load the changes after editing the file.
   service rsyslog restart
   
3. Next you will need to open port 514 in the firewall to accept connections for logging on port 514.  This can be done by adding a rule to the “iptables” file.
   nano /etc/sysconfig/iptables 

   

4. Restart the iptables service to load the new configuration.   
   service iptables restart

Configure a system to log to a remote system

1.  In order to configure a server to export logs you will need to edit the /etc/rsyslog.conf file using your perferred editor and add the following lines.
   nano /etc/rsyslog.conf

   
   As you can see in the highlighted section two items were added.  The first line (*.* @@192.168.1.50:514)  exports logs to a logging server with the IP of 192.168.1.50 on port 514.  The logs will be found in the /var/logdirectory on this server.The second entry (*.* @@localhost:514) saves a copy of the logs on the local server in the /var/logdirectory.  I added this line as I came across this situation while at work and found it to be useful.  There was a situation in which logs were need on a remote server for security audits however the linux admins needed a local copy on the server for administration.If you only need logs o the remote system you can either delete the second entry or make it a comment.

2. After editing the /etc/rsyslog.conf file you will need to restart the logging service
   service rsyslog.conf restart

This server is now to configured to send its logs to the remote server.  You can test this by simply logging in to your machine configured to send the logs to the remote server.  By logging in, you will generate log entries in the /var/log/secure file and you should see the entries on your logging server.

.