Sending Specific Log File to Rsyslog Server

Kali Linux Client: 192.168.0.139
Rocky Linux + Cacti + Rsyslog Server: 192.168.0.6
Port: 514
Using TCP = @, UDP = @@.
Log File to Be Sent from the Client to Rsyslog: 192.168.0.139 /var/webmin/miniserv.log

!! MAKE SURE THE FIREWALL ALLOWS 514/TCP AND 514/UDP !!

Configuration on the Client Side:

1. Open the Rsyslog Configuration File on the Client Side: Open the rsyslog configuration file on the client machine. The rsyslog configuration file is typically located in /etc/rsyslog.conf or in the /etc/rsyslog.d/ directory. sudo nano /etc/rsyslog.conf
2. Add Configuration Rules: Add the following configuration rules to send logs from /var/webmin/miniserv.log to the syslog server with IP address 192.168.0.6 on port 514 using the UDP protocol:

$ModLoad imfile
$InputFileName /var/webmin/miniserv.log
$InputFileTag webmin:
$InputFileStateFile webmin-statefile
$InputFileFacility local7
$InputRunFileMonitor

local7.* @192.168.0.6:514

In the rules above:

• $ModLoad imfile loads the imfile module, which is necessary for monitoring log files.
• $InputFileName is the location of the log file to monitor.
• $InputFileTag is the tag to be added to the sent logs.
• $InputFileStateFile is the state file for monitoring.
• $InputFileFacility is the facility specified for the logs. Here, we use "local7" as an example.
• $InputRunFileMonitor activates file monitoring.

Next, local7.* @192.168.0.6:514 is a rule to send logs with facility "local7" to the syslog server with IP address 192.168.0.6 on port 514 using the UDP protocol.

• Save and Exit: If you’re using the nano editor, press Ctrl+O to save the changes, then Ctrl+X to exit.
• Restart Rsyslog: After saving the configuration, restart the rsyslog service on the client side to apply the changes.

sudo systemctl restart rsyslog

With this configuration, logs from the /var/webmin/miniserv.log file on the rsyslog client machine will be sent to the syslog server at IP address 192.168.0.6 with facility "local7." Make sure the syslog server at that IP address is configured to receive logs from "local7."

Configuration on the Server Side:

1. Configure the file in /etc/rsyslog.conf by using nano /etc/rsyslog.conf
2. Add the following syntax at the bottom of the file:

$ModLoad imudp
$UDPServerRun 514
:fromhost-ip,isequal,"192.168.0.139" /var/log/server/rstoptiplex.log

• $ModLoad imudp: This line loads the imudp module. This module is used to receive logs via the UDP protocol. In other words, rsyslog will listen to log traffic sent via UDP.
• $UDPServerRun 514: This line configures rsyslog to run a UDP receiver service on port 514. Port 514 is the standard port often used to receive logs via the UDP protocol. Rsyslog will listen to incoming traffic on this UDP port.
• :fromhost-ip,isequal,"192.168.0.139" /var/log/server/rstoptiplex.log: This is a log filtering rule. It means that rsyslog will only write logs that originate from the host with IP address 192.168.0.139 to the log file /var/log/server/rstoptiplex.log. So, if any logs come from a host with this IP address, they will be saved in the specified log file.

This configuration as a whole allows rsyslog to receive logs via UDP, then filter logs originating from a specific host (192.168.0.139) and write them to the log file /var/log/server/rstoptiplex.log. This configuration is useful when you want to collect logs from a specific host and store them in a separate log file for further analysis or monitoring.

Result

Rsyslog + Cacti

Reference from chatgpt :)