Lesson 2.32: rsyslog and central logging
Alongside the journal, rsyslog writes the classic text files in /var/log (auth.log, syslog, kern.log) according to rules of facility and severity, and it can forward everything to a central log server. Central logging matters for security: an attacker with root can clean the local logs, but not the copy already sent away, and investigations need logs from many machines in one place. In the lab you read web02's rules, test them with logger, add a TLS forwarding rule with a disk queue, catch a syntax error before it breaks logging, and restart rsyslog.
16 min
You will learn to
- Read rsyslog rules (facility.severity → destination)
- Test logging with logger
- Add TLS forwarding with a queue
- Validate configuration with rsyslogd -N1
- Explain why central logging matters
Key terms
- Facility
- The source category of a syslog message: auth, authpriv, kern, mail, daemon, local0–7…
- Selector
- facility.severity pattern that picks messages for a rule.
- omfwd
- rsyslog's forwarding output module (UDP or TCP, optionally TLS).
- Disk-assisted queue
- Buffers messages on disk while the destination is unreachable.
- SIEM
- Security information and event management: the central system that stores, searches and alerts on logs.
← Command line arguments and options · All lessons · Core dumps that keep secrets →