Multi-host Log Shipper
Forward systemd journals from many hosts to one place.
0 of 6 steps
What you will end up with
Centralized journal forwarding
Filtered, labeled logs
A queryable archive
Build steps
0/6Set up log forwarding on each host so its journal entries also ship to a remote target. journald is each host’s private diary; forwarding photocopies every page into a shared binder.
Run a collector on one host, listening on a port, configured to accept and store incoming log streams. The collector is the shared binder itself, one place instead of twenty scattered diaries.
Configure the collector to tag incoming lines with the sending host’s name and sort them accordingly. Labeling by host means every page in the binder has the diary’s owner stamped on it.
Compress and delete log files past a certain age or size on a schedule. Rotation keeps the binder from becoming an unusable pile by retiring old pages regularly.
Switch from plain forwarding to encrypted forwarding so log contents are not readable in transit. This seals the envelope instead of mailing diary pages on the back of a postcard.
Trigger a known log line on one host and confirm it shows up on the collector within seconds. Send a test letter first, and confirm it actually arrives before trusting the mail system with anything important.
Before you start