Linux - ServerThis forum is for the discussion of Linux Software used in a server related context.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
i want to be able to do redistribution of inbound syslog messages to syslogd. as example, my syslog.conf has in it at the end:
my sysconfig/syslog file has "-r" as the only option for syslogd.
any messages generated by the localhost will be sent to the two remote servers, but messages that come into this box (udp 514) only get logged locally and do not get sent out to the remote hosts.
you may ask why do i want to do this. because i have several syslog servers (for security purposes) and many of my net devices are configured to send syslog to all the syslog servers, hence each device is sending way too much duplicate udp-514. so i would like to minimize the udp-514 coming out of the devices, have all devices send to a central syslog server, and then central syslog server do distribution to the other syslog servers. others have also called this "syslog proxy". or, if not with syslogd, how to achieve this (preserving the original syslog message host info, etc)?
is this possible with syslogd or syslog-ng or rsyslog?
Last edited by Linux_Kidd; 04-28-2010 at 05:30 PM.
Youi could look at using the 'netdump' package to do this as well. We have a number of rhel 4.7 and 5.3 hosts which installed the netdump package on, and rather than using the vmcore dump facility we just used the syslog facility.