So I have my Graylog server set up at location “A”. Setting up inputs and I’m scratching my head on this one:
I have a raspberry pi at location “B”. It serves as a remote access device and logging device for some legacy equipment on the network via rsyslog (/etc/rsyslog.d/temlateHere.conf). It logs 2 devices in addition to the pi itself. I use ZeroTier to connect my devices. All I can do client-side on these legacy devices is point to the server and port to send syslog to.
I have the pi and graylog on the same ZeroTier network. I think: Can I take what’s being logged to the raspberry pi and send that to graylog via another port. I’ve been trying for a few hours and this is what I’ve looked at and came across:
Wondering if any of y’all have come across a situation similar to this, if you see the missing puzzle piece in this that I don’t see, have an answer or “idea”. TIA.
Not certain but I think in rsyslog you can put in
*.* @@GrayLogServer:514
in the /etc/rsyslog.conf of a system running rsyslog (such as your PI) and it will then forward the logs to that server.
Thanks for the reply @LTS_Tom. Unfortunately that sends all logs, from legacy devices and the pi to one input. Essentially 3 separate OS’s to one log mixed together. I explained more on another forum as after reading my original, I didn’t provide clear enough information:
So there’s legacy device 1 and 2. They’re sending logs to the pi that’s running rsyslog and printing the log to their respective outputs (/var/log/legacydevice1.log). I want to send that to my graylog instance at a separate location.
The pi does not have graylog on it. Only rsyslog and other unrelated applications.
I want to send the logs from legacy device 1 on the pi to the graylog server as input: legacy device 1 @x.x.x.x:5141
I want to send the logs from legacy device 2 on the pi to the graylog server as input: legacy device 2 @x.x.x.x:5142
Then, I want to send the logs from the pi syslog to the graylog server as input: pi syslog @x.x.x.x:5143
The legacy devices can’t run the ZeroTier software on them so that’s why the pi sits in the middle.
I hope this explained more. Thanks