How to configure syslog to be sending audit logs to a remote syslog collector


This KB provides step-by-step instructions to configure Versa Director (VD) to forward audit logs to an external Syslog server over TCP/514 [For example], while ensuring the rsyslog daemon has adequate permissions to read the required log files.


1. Update rsyslog Configuration

Edit or create the file:

sudo vi /etc/rsyslog.d/versa-audit-sender.conf

Insert the following configuration:


# Load the imfile module to read log files
module(load="imfile" PollingInterval="10")

# Input for VNMS audit logs with debugging
input(type="imfile"
      File="/var/log/vnms/audit/*.log"
      Tag="vnms-audit"
      Severity="info"
      Facility="local0"
      reopenOnTruncate="on"
      freshStartTail="off")

# Forward to remote syslog server via TCP on port 514
###The IP Port needs to be updated.
local0.* @@10.70.92.12:514

Notes


2. Fix Directory and File Permissions (ACL Updates)

By default, /var/log/vnms and its subdirectories are owned by versa:versa, and the syslog user cannot read them.

Run the following ACL updates:

sudo setfacl -m u:syslog:rx /var/log/vnms
sudo setfacl -d -m u:syslog:rx /var/log/vnms/audit
sudo setfacl -m u:syslog:rx /var/log/vnms/audit/*.log


3. Restart and Validate Rsyslog

Restart the service:

sudo service rsyslog restart

Check status:

sudo service rsyslog status

Expected Output (Example)

admin@Snehal-Director:/var/log$ sudo service rsyslog status
● rsyslog.service - System Logging Service
   Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2025-11-19 19:40:39 CST; 2s ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 1457 (rsyslogd)
    Tasks: 11 (limit: 4915)
   CGroup: /system.slice/rsyslog.service
           └─1457 /usr/sbin/rsyslogd -n

Nov 19 19:40:39 Snehal-Director systemd[1]: Starting System Logging Service...
Nov 19 19:40:39 Snehal-Director rsyslogd[1457]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd.  [v8.32.0]
Nov 19 19:40:39 Snehal-Director systemd[1]: Started System Logging Service.
Nov 19 19:40:39 Snehal-Director rsyslogd[1457]: rsyslogd's groupid changed to 106
Nov 19 19:40:39 Snehal-Director rsyslogd[1457]: rsyslogd's userid changed to 102
Nov 19 19:40:39 Snehal-Director rsyslogd[1457]:  [origin software="rsyslogd" swVersion="8.32.0" x-pid="1457" x-info="http://www.rsyslog.com"] start