{"id":26324,"date":"2023-03-07T08:01:24","date_gmt":"2023-03-07T08:01:24","guid":{"rendered":"http:\/\/localhost\/helpold\/?p=26324"},"modified":"2024-12-07T16:36:36","modified_gmt":"2024-12-07T13:06:36","slug":"rsyslog-on-debian","status":"publish","type":"post","link":"https:\/\/www.arvancloud.ir\/help\/en\/rsyslog-on-debian\/","title":{"rendered":"Installing Rsyslog Server on Debian"},"content":{"rendered":"<p>Controlling and managing log files in Linux-based operating systems are handled by the Rsyslog server, available by default on most versions of Linux. These files are stored in the \/var\/log path and serve an important role in the analysis and troubleshooting of system problems and the services which run on them.<\/p>\n<p>In this guide, we will explain how to configure this service on the Debian operating system.<\/p>\n<h2>Rsyslog Service<\/h2>\n<p>Being capable of acting as both a client and a server, Rsyslog has the ability to send or receive log messages over TCP\/UDP from other devices within the network, such as servers, routers, switches, or other devices which generate logs.<\/p>\n<p>When configured in the server role, Rsyslog can listen on the standard TCP\/UDP port 514 and collect log messages sent by other devices in the system. On the other hand, when Rsyslog is configured as a client, it sends log messages to the Rsyslog server on the system over TCP\/UDP on port 514.<\/p>\n<p>Rsyslog filters fall under one of these three categories:<\/p>\n<ul>\n<li>Priority-based filters<\/li>\n<li>Property-based filters<\/li>\n<li>Expression-based filters<\/li>\n<\/ul>\n<p>Priority filters state the internal Linux processes that generate the log:<\/p>\n<ul>\n<li>auth\/authpriv: Messages that are generated by the authentication process.<\/li>\n<li>cron: Messages associated with corn jobs<\/li>\n<li>daemon: Messages concerning running system services<\/li>\n<li>kernel: Linux kernel-related messages<\/li>\n<li>Mail: Messages associated with the mail server<\/li>\n<li>Syslog: Messages related to syslog<\/li>\n<li>Lpr: Messages that are related to the printer or print server<\/li>\n<li>local0 &#8211; local7: Customized messages controlled by the system administrator.<\/li>\n<\/ul>\n<p>The various priority filter levels are given a number and a keyword, namely:<\/p>\n<ul>\n<li>emerg, panic (level 0): Such a log shows that the system is completely disabled and cannot be used.<\/li>\n<li>alert (level 1): It means that urgent action should be taken.<\/li>\n<li>err (level 3): It means that a critical situation exists.<\/li>\n<li>warn (level 4): Indicates a warning.<\/li>\n<li>notice (level 5): It means that the situation is normal, but additional investigation is required.<\/li>\n<li>info (level 6): It is simply information about an event.<\/li>\n<li>debug (level 7): Debug messages.<\/li>\n<\/ul>\n<h2>Installing Rsyslog<\/h2>\n<p>As we mentioned at the beginning of this article, this service is installed by default on new Linux-based operating systems. But in case it is not installed, you may install it using the following command:<\/p>\n<pre><code class=\"http\">sudo apt-get install rsyslog<\/code><\/pre>\n<p>To make sure that this service has been installed and is active, you can use the following command:<\/p>\n<pre><code class=\"http\">systemctl status rsyslog.service<\/code><\/pre>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"size-full wp-image-26065 aligncenter\" src=\"https:\/\/www.arvancloud.ir\/help\/wp-content\/uploads\/2024\/12\/\u0646\u0635\u0628-rsyslog-server-\u0631\u0648\u06cc-debian-360034318833_rsyslog-debian-1-1.png\" alt=\"\" width=\"1276\" height=\"340\" \/><\/p>\n<p>You must change the settings in the \/etc\/rsyslog.conf file to configure Rsyslog as a server. Use the following command to access this file:<\/p>\n<pre><code class=\"http\">sudo vi \/etc\/rsyslog.conf<\/code><\/pre>\n<p>During the next step, you can enter editing mode by pressing the letter I on the keyboard and then remove the # character from the following phrases &#8220;provides TCP syslog reception&#8221; and &#8220;provides UDP syslog reception&#8221; so you can uncomment them:<\/p>\n<p><img decoding=\"async\" class=\"size-full wp-image-26067 aligncenter\" src=\"https:\/\/www.arvancloud.ir\/help\/wp-content\/uploads\/2024\/12\/\u0646\u0635\u0628-rsyslog-server-\u0631\u0648\u06cc-debian-360034318833_rsyslog-debian-2-1.png\" alt=\"\" width=\"1316\" height=\"455\" \/><\/p>\n<p>You can use the following command, which should be added after the (type=&#8221;imtcp&#8221; port=&#8221;514&#8243;) phrase so that you can set the access restriction for a specific subnet, IP or domain (you must enter the desired IP instead of x.x.x.x).<\/p>\n<pre><code class=\"http\">AllowedSender TCP, 127.0.0.1, x.x.x.x\/24, *.yourdomain.com<\/code><\/pre>\n<h2>Creating a Template<\/h2>\n<p>Using the template you can specify how the logs for Rsyslog shall be stored. Type the template definition commands after the above command.<\/p>\n<pre><code class=\"http\">template Incoming-logs,\"\/var\/log\/%HOSTNAME%\/%PROGRAMNAME%.log\" *.* ?Incoming-logs <\/code><\/pre>\n<p>For Rsyslog server of version 7 or later, you can define templates in the following format:<\/p>\n<pre><code class=\"http\">template(name=\"MyTemplate\" type=\"string\" string=\"\/var\/log\/%FROMHOST-IP%\/%PROGRAMNAME:::secpath-replace%.log\" )<\/code><\/pre>\n<p>You can also use this format as follows:<\/p>\n<pre><code class=\"http\">template(name=\"MyTemplate\" type=\"list\") { constant(value=\"\/var\/log\/\") property(name=\"fromhost-ip\") constant(value=\"\/\") property(name=\"programname\" SecurePath=\"replace\") constant(value=\".log\") }<\/code><\/pre>\n<p>When you insert the above command into the Rsyslog configuration file, it will record log messages in the \/var\/log path using the format that is specified in the command. You can use the following variables in addition to the ones mentioned in the above command:<\/p>\n<pre><code class=\"http\">%syslogseverity%, %syslogfacility%, %timegenerated%, %HOSTNAME%, %syslogtag%, %msg%, %FROMHOST-IP%, %PRI%, %MSGID%, %APP-NAME%, %TIMESTAMP%, %$year%, %$month%, %$day%<\/code><\/pre>\n<p>To register the changes applied in the Rsyslog configuration file, you need to restart this service. Use the following commands to do that:<\/p>\n<pre><code class=\"http\">sudo service rsyslog restartsudo systemctl restart rsyslog<\/code><\/pre>\n<p>In the end, to confirm that Rsyslog is properly listening on both the TCP and UDP ports, use the following command:<\/p>\n<pre><code class=\"http\">sudo netstat -taupn | grep rsyslog\r\n\r\n<img data-dominant-color=\"eeecec\" data-has-transparency=\"false\" style=\"--dominant-color: #eeecec;\" decoding=\"async\" class=\"size-full wp-image-27857 aligncenter not-transparent\" src=\"https:\/\/www.arvancloud.ir\/help\/wp-content\/uploads\/2024\/12\/\u0646\u0635\u0628-rsyslog-server-\u0631\u0648\u06cc-debian-360034318833_rsyslog-debian-3.png\" alt=\"\" width=\"1187\" height=\"182\" \/><\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Controlling and managing log files in Linux-based operating systems are handled by the Rsyslog server, available by default on most versions of Linux. These files are stored in the \/var\/log path and serve an important role in the analysis and troubleshooting of system problems and the services which run on them. In this guide, we [&hellip;]<\/p>\n","protected":false},"author":79,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"r1_post_views_count":"703","feedback_yes":"0","feedback_no":"0","ads_id_sidebar":"","ads_id_content":"","footnotes":""},"categories":[251,245],"tags":[],"class_list":["post-26324","post","type-post","status-publish","format-standard","hentry","category-app-development","category-cloud-server"],"lang":"en","translations":{"en":26324},"pll_sync_post":[],"_links":{"self":[{"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/posts\/26324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/users\/79"}],"replies":[{"embeddable":true,"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/comments?post=26324"}],"version-history":[{"count":2,"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/posts\/26324\/revisions"}],"predecessor-version":[{"id":27904,"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/posts\/26324\/revisions\/27904"}],"wp:attachment":[{"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/media?parent=26324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/categories?post=26324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.arvancloud.ir\/help\/wp-json\/wp\/v2\/tags?post=26324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}