How to collect syslog for an appliance without the agent

If you already have a central syslog server, you can forward syslog traffic to a virtual appliance or a physical appliance.

The image below summarizes how logs are collected with an existing central syslog server.

If you don't have a central syslog server already established or you wish to have a separate collection path, you can install either a virtual appliance or a physical appliance and send syslog traffic directly to the appliance.

The image below summarizes how logs are collected without a central syslog server.

The Alert Logic Log Manager appliance listens for syslog data on TCP and UDP port 514. The appliance will process any syslog traffic directed to the local IP address of your appliance.

The following examples apply to common Linux and Unix syslog daemons.

To configure Rsyslog (RedHat Enterprise Linux, Fedora, etc.):

1. Add a line to /etc/rsyslog.conf

   • For TCP collection: *.* @@IP of sensor: 514

   • For UDP collection: *.* @IP of sensor: 514

2. Restart rsyslog: /etc/init.d/rsyslog restart

To configure Syslogd (Solaris, legacy Unix):

1. Add a line to /etc/syslog.conf: *.debug @IP of sensor

2. Restart syslog with one of the following commands:

   • svcadm restart svc:/system/system-log:default

   • /etc/init.d/syslog restart