Linux configuration

Linux systems can utilize a number of different syslog tools to send logs to the Comm Broker.

To edit the Rsyslog configuration:

When configuring Rsyslog for CentOS and Red Hat 5 and 6, be sure the fully qualified domain name (FQDN) of the Comm Broker is registered in DNS, and the server can resolve the name correctly.

Open /etc/rsyslog.conf for editing.

Add the following lines to the body of the file:

Note
In this script @ implies UDP is used, and @@ will use TCP.

# ### begin forwarding rule ###
# These messages will log to the Communications Broker Auth.info 
@CommBroker.company.com:514 Authpriv.info 
@CommBroker.company.com:514 Cron.* 
@CommBroker.company.com:514 Daemon.crit 
@CommBroker.company.com:514 Kern.crit 
@CommBroker.company.com:514
Uncomment the following lines to cache logs on hard disk:
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueuSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.*@CommBroker.company.com:514 
#this final line specifies the forwarding location

Ensure rsyslog runs at boot:
```
chkconfig rsyslog on
```
Restart the service:
```
service rsyslog restart
```

To edit the Syslog-ng Configuration for Ubuntu LTS:

Open /etc/syslog-ng/syslog-ng.conf for editing.
Define a new destination:
```
destination d_commbroker {syslog ("10.1.1.1"transport("udp")port(514));};
```
Replace "10.1.1.1" with the IP address of the Comm Broker.

Add this destination to the appropriate log definition:

log {
source(s_network); 
# example existing log source source(s_bro_conn); 
# example existing log source destination(d_commbroker);
}

Restart the service:
```
service syslog-ng restart
```