Showing results for 
Show  only  | Search instead for 
Did you mean: 

Can you syslog to 2 devices?

Can I just add a second line to the rsyslog.conf file to send my logs to a 2nd source?



4 Replies

Re: Can you syslog to 2 devices?


Just add a second line.

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 5

Re: Can you syslog to 2 devices?

You can indeed by adding a second line! But....

You might also want to consider sending specifically formatted messages to specific destinations.

Say you have a McAfee ESM and a splunk. The ESM logline uses the Nitro format, and the Splunk format uses CEF (for example).

To send a message to the syslog daemon we have this rule in the logging cycle, 6 = Info:

ESM is already configured as: @esm

OR possibly:

*.* @esm

If you do the following for splunk: @splunk

This would mean that esm and splunk receive both messages (the nitro format, and the splunk format).

  1. McAfeeWG|time_stamp=[01/Jan/2015:02:12:31 +0800]|auth_user=jsmith|src_ip=|server_ip=||url_port=80|status_code=301|bytes_from_client=279|bytes_to_client=1149|categories=Business, Software/Hardware|rep_level=Minimal Risk|method=GET|url=|media_type=text/html|application_name=|user_agent=Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)|block_res=0|block_reason=|virus_name=|hash=|filename=|filesize=753| 
  2. CEF:0|McAfee|Web Gateway|7.3.2|301|Proxy--|2|rt=Sep 02 2013 16:55:57 cat=Access Log dst= suser=jsmith src= requestMethod=GET request= app=HTTP cs3=HTTP/1.1 cs3Label=Protocol/Version cs4=Business, Software/Hardware cs4Label=URL Categories cs6=Minimal Risk cs6Label=Reputation fileType=text/html out=1182 requestClientApplication=Mozilla/5.0 Firefox/23.0 cs1= cs1Label=Virus Name cn1=0 cn1Label=Block Reason cs5=Default cs5Label=Policy 

If we want ESM to only get #1, and splunk to only get #2, we would modify the logging rule to use 7 (debug) instead of 6 (info). In the rsyslog conf we would have a line like:

daemon.=debug @splunk

This would ensure only daemon.debug events are sent to the second syslog server (splunk).

Hope this helps. If it doesnt matter what message is sent where, then adding a second line would be fine.

Best Regards.



Re: Can you syslog to 2 devices?

Hi Jon,

That is helpful.

Thank you,



Re: Can you syslog to 2 devices?

Hi Jon

I am trying to understand the result of what you have described here. If we configure Log Handler 1 as Syslog (7. User-Defined.syslogline) and Log handler 2 as Syslog (7, User-Defined.syslogline_2) e.g., and then configure the ryslog file to use daemon.=debug @syslog_server1 and daemon.=info @syslog_server2, this means that syslog_server1 will receive all the debug level messages and above, and syslog_server2 only the info level messages if I understand correctly?

What if we need to have both servers receive exactly the same logs, just in different log line formats (e.g. if we are running two SIEM solutions in parallel.

Kind Regards


You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community