Hi,
syslog-ng can deliver messages to another host easily, using the generic network() or the more specific udp()/tcp() drivers. The fw can consume them with similar source drivers. syslog-ng supports various protocols and formats for this transport (namely the newer RFC5424 or the legacy BSD format RFC3164).
This is a very simple config on the clients to send off the messages to fw:
```
@version 3.30
log {
source { system(); };
destination { network("fw.lan" transport(tcp)); };
};
```
On the server (fw):
```
@version: 3.30
log {
source { network(transport(tcp)); };
destination { file("/var/log/network-messages"); };
};
```
The examples above use the "inline" syntax, where the drivers are specified right within the log statement that processes their message flow. You can also declare a source and then reference them in a log statement.
```
@version 3.30
source s_local {
system();
};
log {
source(s_local);
destination { network("fw.lan" transport(tcp)); };
};
```
See the curly vs. simple brackets around the source reference, that's the indication if you want to use in-line statements. The separate declaration of a source allows it to be used from multiple log statements, whereas the inline would only allow a single log statement to be used.
The network() driver would use RFC3164 format on plain TCP, but you can customize this (the syslog() driver would use RFC5424, and the transport() option for either of these specifies which transport protocol is used: simple UDP, TCP or TLS).
That should get you started. If you try to google for syslog-ng, I am sure you would find tutorials. Some books even include chapters on its configuration format. And there's the official documentation on
syslog-ng.com.
Hope this helps,
Bazsi