How to setup rsyslog to get Event Logs from a second maschine

The Article is applicable to all versions of EventReporter, MonitorWare Agent and rsyslog.

1. Configure EventReporter with a Service “Eventlog Monitor Service”.

Attention if you use Windows Vista or Windows 7 skip to step 1.2.

First, right click on “Services”, then select “Add Service” and then “Event Log Monitor”:

Once you have done so, a new wizard starts.
If the following Pop-up appears, please select “Create Service”:

Again, you can use either the default name or any one you like. We will use “My Event Log Monitor” in this sample. Leave the “Use default settings” selected and press “Next”.

As we have used the default, the wizard will immediately proceed with step 3, the confirmation page. Press “Finish” to create the service. The wizard completes and returns to the configuration client.

Now, you will see the newly created service beneath the “Services” part of the tree view. To check its parameters, select it. Click on Advanced Options then select “Use Legacy Format” :

1.2 Configure EventReporter with a Service “Eventlog Monitor Service 2”.
Note: This guide explains how to set up the EventLog Monitor Service for Windows Vista. These steps are not applicable if you are using Windows XP.

First, right click on “Services”, then select “Add Service” and then “Event Log Monitor V2”:

Once you have done so, a new wizard starts.
If the following Popup appears, please select “Create Service”:

Again, you can use either the default name or any one you like. We will use the default name in this sample. Leave the “Use default settings” selected and press “Next”.

As we have used the default, the wizard will immediately proceed with step 3, the confirmation page. Press “Finish” to create the service. The wizard completes and returns to the configuration client.

Now, you will see the newly created service beneath the “Services” as part of the tree view. To check its parameters, select it:

As you can see, the service has been created with the default parameters.

2. Add a “Forward via Syslog” Action.

First we define a new rule set. Right-click “Rules”. A popup menu will appear. Select “Add Rule Set” from this menu. On screen, it looks as follows:

Then, a wizard starts. Change the name of the rule to whatever name you like. We will use “Forward syslog” in this example. The screen looks as follow:

Click “Next” to go on with the next step.
Select only Forward via Syslog. Do not select any other options for this sample. Also, leave the “Create a Rule for each of the following actions” setting selected. Click “Next”. You will see a confirmation page. Click “Finish” to create the rule set.

As you can see, the new Rule Set “Forward syslog” is present. Please expand it in the tree view until the action level of the “Forward syslog” Rule and select the “Forward syslog” action to configure.

3. Configure the “Forward via Syslog” Action.

Now, we are going to configure the necessary settings for forwarding via syslog. Type the IP or the hostname of your syslog server into the Syslog Server field in the form. Then Change the protocol to “TCP (octet-count based framing”. We use TCP that we will have no traffic lost. And edit the Port to 10514. Attention EventReporter and rsyslog must use the same port and the same protocol.

4. Configure Event Log Monitor which Rule to use.

Then Left-Click on Event Log Monitor then change “Rule Set to Use” to your Rule set. On the screen, it looks as follows:

5. Setup rsyslog for TCP reception

Now, we are going to configure the necessary settings for the TCP reception. Because EventReporter forward via syslog over a TCP connection so rsyslog must reception TCP.

Then open the rsyslog configuration. The normal path is “/etc/rsyslog.conf” and copy and paste this code into the Configuration.
Use this code for the TCP Syslog reception:

# Provides TCP Syslog reception
$ModLoad imtcp.so
$InputTCPServerRun 10514

If you use a UPD connection then use this code:

# Provides UDP syslog reception
$ModLoad imudp.so
$UDPServerRun 10514

Please restart rsyslog afterwards.
6. Test rsyslog

First switch to your Unix machine then open a new command prompt under Unix then type “tail -f /var/log/syslog”. With this command you now see all log messages which rsyslog receive.

Then open a new command prompt and write “logger test 1231”. Then you must see the message in the first command prompt.

On the screen, it looks as follows:

7. Verifying the configuration of rsyslog and EventReporter

First open a new command prompt under Unix then type “tail -f /var/log/syslog”.

Then switch to the second machine and start EventReporter. Then switch to your Unix machine and watch the command prompt there you see the incoming “Eventlogs” in the command prompt.
On the screen its look like:

If nothing arrive then check your EventReporter and rsyslog configuration if both use the same port and if both use the same protocol.

That’s it. This is how to receive syslog data from another device.