Fedora Linux

# See klogd(8) for more details
KLOGD_OPTIONS='-x'
#
SYSLOG_UMASK=077
# set this to a umask value to use for all logfiles, as in umask(1).
# By default, all permissions are removed for 'group' and 'other'.

Change the SYSLOGD_OPTIONS line to include -r (remote logging):

SYSLOGD_OPTIONS='-m 0 -r'

Then restart syslogd :

# service syslog restart
Shutting down kernel logger: [ OK ]
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]
Starting kernel logger: [ OK ]

Ensure that your firewall configuration permits connections on UDP port 514.

Next, edit the file /etc/syslog.conf on the machines that will be forwarding log messages to the syslog server, and add this line:

*.* @ syslogserver

This will forward all messages to the remote host syslogserver (which may be an IP address or hostname). Restart syslogd to activate the changes.  

It's important to leave local logging turned on in case the syslog server is unavailable, so don't remove the lines that write to the local logfiles.

The result will be a combined log containing entries from both the syslog server and the host that is forwarding its log messages:

Jun 1 02:52:33 darkday named[13255]: starting BIND 9.3.2 -u named
Jun 1 02:52:33 darkday named[13255]: found 1 CPU, using 1 worker thread
Jun 1 02:52:33 darkday named[13255]: loading configuration from '/etc/named.conf'
Jun 1 02:52:33 darkday named[13255]: listening on IPv4 interface lo, 127.0.0.1#53
Jun 1 02:52:33 darkday named[13255]: listening on IPv4 interface eth0, 172.16.97.100#53
Jun 1 02:52:33 darkday named[13255]: command channel listening on 127.0.0.1#953
Jun 1 02:52:33 darkday named[13255]: zone 0.in-addr.arpa/IN: loaded serial 42
Jun 1 02:52:33 darkday named[13255]: zone 0.0.127.in-addr.arpa/IN: loaded serial 1997022700
Jun 1 02:52:33 darkday named[13255]: zone 255.in-addr.arpa/IN: loaded serial 42
Jun 1 02:52:33 darkday named[13255]: zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 1997022700
Jun 1 02:52:33 darkday named[13255]: zone localdomain/IN: loaded serial 42
Jun 1 02:52:33 darkday named[13255]: zone localhost/IN: loaded serial 42
Jun 1 02:52:33 darkday named[13255]: running
Jun 1 02:57:22 bluesky chris: VNC service configured, restarting xinetd
Jun 1 02:57:29 bluesky xinetd[15394]: Exiting...
Jun 1 02:57:29 bluesky xinetd[15452]: xinetd Version 2.3.13 started with libwrap loadavg options compiled in.
Jun 1 02:57:29 bluesky xinetd[15452]: Started working: 1 available service

Notice that this log contains entries from darkday (the syslog server) as well as from bluesky (which is forwarding log messages to darkday ). Notice also the system administrator's note on bluesky , stating the reason that xinetd was being restarted.

8.7.1.5. Automated log watching

There's not much point in collecting all this information if the logs are never read, but reading logfiles is boring, tedious work. Fortunately, the logwatch package automates this process, sending a daily summary email to alert you to important log entries.

The daily summary is emailed to root on the local machine. Email to the root user should be redirected to a specific user or users by the /etc/aliases file. Edit this file and uncomment the entry for root found at the the end, inserting the name of a user who is responsible for administering the system (or a list of people separated by commas). In this example, all mail for root is redirected to [email protected] :

# Person who should get root's mail
root: [email protected]

Here is a typical daily logwatch summary:

From: root <[email protected]>
To: [email protected]
Subject: LogWatch for bluesky.fedorabook.com
Date: Wed, 31 May 2006 04:02:17 -0400
################### LogWatch 7.1 (11/12/05) ####################
Processing Initiated: Thu Jun 1 02:52:14 2006
Date Range Processed: yesterday ( 2006-May-31 )
Period is day.
Detail Level of Output: 10
Type of Output: unformatted
Logfiles for Host: bluesky.fedorabook.com
################################################################# #
--------------------- httpd Begin ------------------------
A total of 3 unidentified 'other' records logged
GET /level/16/exec/-///pwd HTTP/1.0 with response code(s)