rsyslog Centralized Log Audit: Unified Server Log Collection

rsyslog centralized log audit: full server/client config, templates and forward rules, TLS transport, logrotate retention. Pull syslog, Nginx, and firewall logs from many hosts into one sink for security audit and attack tracing.

Use cases

rsyslog centralized log audit fits ops/security teams that need one sink for multi-host syslog, Nginx access logs, firewall, and database logs. Past ~5 hosts, hopping boxes to grep logs is slow. An attacker wiping a single host erases local evidence. Forward logs in real time to a central rsyslog server: store, search, retain. Full chain for audit, intrusion tracing, and compliance.

Prerequisites

• One central log server (dedicated 2 vCPU / 4 GB+; size disk to log volume)
• Linux clients to onboard
• rsyslog installed on all nodes (stock on CentOS/RHEL 7+ and Ubuntu 16.04+)
• Network path between clients and server; default UDP/TCP 514

How it works

rsyslog speaks syslog. Clients tag messages by facility and severity, then send them to the server. The server writes files via templates, partitioned by host and date. Lighter than ELK: no Java, one box can ingest thousands of devices. TLS module encrypts the wire so logs cannot be sniffed or tampered in transit.

Procedure

1. Configure the central log server

`# Edit the server configuration
vim /etc/rsyslog.conf
# Uncomment the following three lines to enable TCP reception
module(load="imtcp")
input(type="imtcp" port="514")
$ModLoad imudp
$UDPServerRun 514

# Append template at the end of the file: archive by client IP and date
$template RemoteLogs,"/var/log/remote/%fromhost-ip%/%$YEAR%-%$MONTH%-%$DAY%.log"
*.* ?RemoteLogs

# Restart rsyslog and open the firewall
systemctl restart rsyslog
firewall-cmd --permanent --add-port=514/tcp --add-port=514/udp
firewall-cmd --reload`

2. Configure client forwarding

`# Edit the client configuration
vim /etc/rsyslog.d/50-forward.conf
# Append the following; *.* forwards all logs
*.* @10.0.0.10:514

# Use @@ for TCP, single @ for UDP
# *.* @@10.0.0.10:514

systemctl restart rsyslog
logger -t test "rsyslog forward test"`

3. Forward Nginx access logs

`# Configure in the http block of nginx.conf
log_format json_escape escape=json '{'
  '"time":"$time_iso8601",'
  '"remote_addr":"$remote_addr",'
  '"request":"$request",'
  '"status":$status,'
  '"body_bytes_sent":$body_bytes_sent,'
  '"http_user_agent":"$http_user_agent"'
'}';
access_log syslog:server=10.0.0.10:514,tag=nginx,facility=local6 json_escape;

# Test
nginx -t && nginx -s reload`

4. Logrotate and retention

`# /etc/logrotate.d/remote
/var/log/remote/*/*.log {
    daily
    rotate 90
    compress
    delaycompress
    missingok
    notifempty
    create 0640 syslog adm
    sharedscripts
    postrotate
        /usr/bin/systemctl kill -s HUP rsyslog.service
    endscript
}`

5. TLS transport (optional)

`# Generate a self-signed certificate on the server (use a CA-issued cert in production)
mkdir -p /etc/rsyslog-tls && cd /etc/rsyslog-tls
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
  -keyout server.key -out server.crt -subj "/CN=logserver"

# Add to the server configuration file
module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1" StreamDriver.AuthMode="anon")
input(type="imtcp" port="6514")

# Switch the client configuration to TLS
module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1" StreamDriver.AuthMode="anon")
*.* @@10.0.0.10:6514
# Also copy server.crt to the client /etc/rsyslog-tls/ and configure the Global CA`

Verify

`# View received logs on the server
tail -f /var/log/remote/10.0.0.20/$(date +%Y-%m-%d).log

# Confirm the client sent the message
logger -t test "hello central log"
# The server should show a new line containing "hello central log"

# Check that the port is listening
ss -lntup | grep 514
# Measure daily log volume and assess disk usage
du -sh /var/log/remote/`

FAQ

FAQ 1: Client restarts and forwarding stops?

Check that imtcp is loaded on the server, 514 is not blocked by the firewall, and `systemctl status rsyslog` has no errors. UDP drops packets with no retry. Use TCP (`@@`) for critical logs.

FAQ 2: Log timestamps disagree with local time?

syslog carries the sender clock. NTP-sync all hosts (`chronyc sources`). Add `%timegenerated%` in the template for receive time so you can compare both timestamps during tracing.

FAQ 3: Log files grow too fast?

logrotate daily + compress (90-day retain in the example). Split by facility in templates—e.g. archive nginx access logs separately. Cap debug noise on the client, e.g. `*.info;mail.none;authpriv.none;cron.none @10.0.0.10:514`.

Summary

rsyslog centralized audit: minimal change, one sink. Server archives by source IP and date. Clients add one line. App logs (Nginx) can go out as JSON. Security then hunts, traces, and audits from a single source. Pair with ELK or Grafana Loki for search and alerts. Cheapest first step toward a log-audit stack.