Syslog Server
To forward system and security events to a syslog server, add to the /etc/rsyslog.conf the following lines (you must be root to do this):
#rules to forward system & security events to syslog server
module(load="imfile")
input(type="imfile" File="/var/log/nem/log/nem-system-event.log" Tag="system" Severity="info" Facility="user" ruleset="remote")
input(type="imfile" File="/var/log/nem/log/nem-security-event.log" Tag="security" Severity="info" Facility="user" ruleset="remote")
ruleset(name="remote"){
action(type="omfwd" target="xxx.xxx.xxx.xxx" port="514" protocol="udp")
}
Replace the xxx.xxx.xxx.xxx with the syslog server IPv4 address and restart the rsyslog via the command:
systemctl restart rsyslog.service