2

I want to create a systemd service, which would start an extra instance of syslog (I assume rsyslogd, as this seems to be what's installed on my Xenial?). I want it to listen on specified socket (unprivileged) as a "syslog server", and dump all received logs to some file. I want it to run unprivileged (that is, as a non-root user).

Assuming I created new user logdumper and put the following lines in /etc/systemd/[email protected]:

[Unit]
Description=Unprivileged syslog server on port %i

[Service]
User=logdumper
Restart=always
ExecStart=/usr/sbin/rsyslogd -n -f /home/logdumper/rsyslogd-port-%i.conf \
    -i /home/logdumper/rsyslogd-port-%i.pid

[Install]
WantedBy=multi-user.target

what should I put in /home/logdumper/rsyslogd-port-%i.conf? Also, is my ExecStart OK?

Let's say I want it to listen on port 9999 (thus, %i=9999), and dump received data to /home/logdumper/rsyslogd-port-9999.log.

1 Answer 1

1

So, it seems that something like below works for me as rsyslogd-port-9999.conf:

$ModLoad imudp
$UDPServerRun 9999

$ModLoad imtcp
$InputTCPServerRun 9999

$ModLoad immark   # not sure what's this, but seems popular

$template Template_WithSrcHost,"%timegenerated:::date-rfc3339% %HOSTNAME% %FROMHOST% %syslogtag%%msg:::drop-last-lf%\n"

*.* /home/logdumper/rsyslogd-port-9999.log;Template_WithSrcHost

I built this based on man rsyslog.conf. The $template directive is to add %FROMHOST%, which in my case is a better IP than %HOSTNAME%.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .