How to configure a Ubuntu 18.04 LTS server as a rsyslog server?

How to configure a Ubuntu 18.04 LTS server as a rsyslog server

Ubuntu systems can be configured to act as central Syslog servers that collect, and analyze Syslogs from various other devices. Below are the steps to configure a central rsyslog server that runs on Ubuntu 18.04 LTS.

• You can install rsyslog on Ubuntu OS by running the command,
  Copy

                      apt-get install rsyslog -y
                  

• Enter the following command to see if the status of rsyslog is Active: active (running),
  Copy

                      systemctl status rsyslog
                  

• Search and uncomment the following lines in /etc/rsyslog.conf to enable TCP and UDP connections,
  Copy

                      $ModLoad imudp
                      $UDPServerRun 514
                      $ModLoad imtcp
                      $InputTCPServerRun 514
                  

Note:

Port 514 is the default port of UDP and TCP. At anytime, you can change the port number.

• Next, give permissions to the IPs, domains and subnets that can use port 514 using the command:
  Copy

                      $AllowedSender TCP
                      $AllowedSender UDP
                  

• Create a template which specifies the files under which the received logs should be stored by using the following command,
  Copy

                      $template remote-incoming-logs,
                      "/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
                      *.* ?remote-incoming-logs
                  

• Save the configuration and close.
• To verify if your rsyslog daemon is listening on port 514, run the following command,
  Copy

                      netstat -4altunp | grep 514 and see if the output shows LISTEN against TCP AND UDP fields.
                  

• To view the logs collected in real-time, enter the following command on the rsyslog server,
  Copy

                 ls /var/log/rsyslog-client/
              

How to monitor rsyslogd files?

Simply viewing rsyslogs won't suffice, as you have to interpret and analyze the logs across different files for critical events like authorization failures and unusual system configuration changes. Syslogs contain essential information about who did what, from where and when for all events. These insights enable you to identify anomalous activities in your network devices, and help in mitigating threats and preventing attacks. Manually doing this would be tedious. A log management solution would do all these for you.

EventLog Analyzer, an effective log management solution interprets and analyzes log data to generate intuitive reports. Alerts can be configured using EventLog Analyzer to flag deviant behavior as threats, and you can be notified in real-time via SMS or email about an impending attack. Click here to know more.