How to Configure a Centralized Syslog Server in Ubuntu Using rsyslog

The Importance of Centralized Logging

If you manage dozens of Linux servers, logging into each one individually to parse through /var/log/syslog to find an error is incredibly inefficient. Worse, if one of your web servers is compromised by an attacker, the very first thing they will do is delete the local log files to cover their tracks. By configuring a centralized syslog server, all of your client machines instantly forward their log events to a secure, remote vault. Even if a client server is destroyed, the logs survive.

Fortunately, you do not need to install complex third-party software like Splunk or ELK just to achieve basic central logging. Ubuntu ships with rsyslog pre-installed, and with a few configuration tweaks, you can turn any Ubuntu machine into a powerful centralized log server.

Step 1: Configure the Rsyslog Server

Log into the Ubuntu server that will act as your central vault. We need to tell the rsyslog daemon to start listening for network connections, as it only listens locally by default.

Open the primary configuration file:

sudo nano /etc/rsyslog.conf

Scroll down to the MODULES section. You will see lines for UDP and TCP reception that are commented out with a hashtag (#). Uncomment them by removing the hashtag so they look exactly like this:

module(load="imudp")
input(type="imudp" port="514")

module(load="imtcp")
input(type="imtcp" port="514")

Step 2: Create a Custom Log Template

By default, rsyslog will dump every incoming remote log directly into its own local /var/log/syslog file. This creates an unreadable mess of intertwined logs. Instead, we want rsyslog to dynamically create a separate folder for each remote server based on its hostname.

Scroll to the bottom of /etc/rsyslog.conf and add this custom template:

$template remote-incoming-logs,"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?remote-incoming-logs
& ~

Save and close the file (Ctrl+O, Enter, Ctrl+X).

Step 3: Restart the Service and Open the Firewall

Restart the rsyslog daemon to apply the changes:

sudo systemctl restart rsyslog

Next, ensure your Uncomplicated Firewall (UFW) allows incoming traffic on port 514 for both TCP and UDP:

sudo ufw allow 514/tcp
sudo ufw allow 514/udp

Step 4: Configure the Client Servers

Now, log into any of your other Ubuntu machines (the clients). You do not need to modify rsyslog.conf here. Instead, create a new configuration file in the rsyslog.d directory:

sudo nano /etc/rsyslog.d/60-forwarding.conf

Add the following line, replacing 10.0.0.50 with the actual IP address of your new centralized log server:

*.* @@10.0.0.50:514

Note: Using two at-symbols (@@) forces the client to use TCP, which guarantees delivery. Using one at-symbol (@) uses UDP, which is faster but does not guarantee delivery if the network drops a packet.

Save the file and restart the client service:

sudo systemctl restart rsyslog

Step 5: Verify Log Delivery

Return to your centralized syslog server. Navigate to the /var/log directory and look for the new remote folder we defined in our template:

cd /var/log/remote/
ls -l

You should now see individual directories automatically created for every client hostname. Inside those directories, the logs are beautifully separated by program name (e.g., sshd.log, cron.log), giving you an enterprise-grade central logging system using nothing but native Ubuntu tools.