Centralized Log Server with rsyslog + logrotate

This project sets up a centralized logging server that collects logs from multiple Linux clients using rsyslog. It also includes logrotate to automatically rotate, compress, and manage log files, ensuring efficient disk usage and forensic readiness.

---

Features

• Collects logs from multiple Linux hosts.
• Supports secure log forwarding over TCP/UDP.
• Automated log rotation and compression with logrotate.
• Ready for auditing and incident response.

---

Architecture

• Log Server: Receives logs and stores them in /var/log/remote/.
• Log Clients: Forward their local logs to the central server.
• Logrotate: Prevents disk space issues by compressing and rotating logs.

---

Setup Instructions

1. Server Setup

Run:

sudo bash setup_rsyslog_server.sh

2. Client Setup

sudo bash setup_rsyslog_client.sh <LOG_SERVER_IP>

3. Test on a Client

logger "Test message from client"

Then Check: /var/log/remote/<CLIENT_HOSTNAME>/syslog.log