→ Applies to: SynetoOS 6.x and above

SynetoOS 6 uses rsyslog. The Syneto-supplied ruleset at /etc/rsyslog.d/syneto.conf sorts platform logs into dedicated local files and then stops further processing for each one (& stop). That file is managed by Syneto and must not be edited.

To forward logs off-box, create a new config file that rsyslog loads and applies before syneto.conf. Rsyslog processes files in /etc/rsyslog.d/ in alphabetical order, so a filename like 10-forward.conf loads before syneto.conf and lets you forward a copy of each log before syneto.conf's & stop rules remove it from the pipeline.

NOTE
If the system is part of a 2-node HA/cluster pair, repeat this configuration on both nodes — rsyslog configuration is local to each node.

Available Logs

Step 1. Connect to SynetoOS appliance via SSH as admin

ssh admin@<your_ip_address_or_hostname>

Step 2. Get root privileges

sudo su -

Step 3. Create the Forwarding Config File

vi /etc/rsyslog.d/10-forward.conf

NOTE
No category is forwarded by default. Uncomment only the rules for the categories you want shipped, including the "forward everything" line if that's the intent.

IMPORTANT
Make sure to copy and paste the exact lines below (Replace <remote_syslog_ip> with your log collector's IP and adjust the port if it doesn't listen on 514. Uncomment only the categories you want shipped)

# ===============================================================
#  File: /etc/rsyslog.d/10-forward.conf
#  Purpose: Forward selected SynetoOS 6 logs to a remote log
#           collector, BEFORE /etc/rsyslog.d/syneto.conf's
#           "& stop" rules remove them from the pipeline.
#  Load order: Processed before /etc/rsyslog.d/syneto.conf
#  Protocol: TCP (reliable) shown below; use single "@" for UDP
#  Remote collector: Replace <remote_syslog_ip> with your
#  destination IP
# ===============================================================

# ---------------------------------------------------------------
#  Uncomment this single line to forward EVERYTHING instead of
#  picking individual categories below.
# ---------------------------------------------------------------
#*.* @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  Web interface logs
#  Local path: /var/log/web.log
# ---------------------------------------------------------------
#:programname, isequal, "Web" @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  Syneto Audit logs
#  Local path: /var/log/audit/syneto-audit.log
# ---------------------------------------------------------------
#:programname, isequal, "Audit" @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  Syneto CLI logs
#  Local path: /var/log/cli.log
# ---------------------------------------------------------------
#:programname, isequal, "Cli" @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  Syneto App (background tasks) logs
#  Local path: /var/log/app.log
# ---------------------------------------------------------------
#:programname, isequal, "App" @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  systemd logs
#  Local path: /var/log/systemd.log
# ---------------------------------------------------------------
#:programname, isequal, "systemd" @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  ESXi logs (hosts forwarding syslog to this node)
#  Local path: /var/log/esxi/<host_ip>/message.log
# ---------------------------------------------------------------
#:fromhost-ip, startswith, "<esxi_subnet_prefix>" @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  nginx access/error logs
#  nginx writes these directly to disk, not to syslog, so they
#  first need to be picked up with imfile before they can be
#  forwarded. Uncomment the whole block to enable.
#  Local path: /var/log/nginx/access.log, /var/log/nginx/error.log
# ---------------------------------------------------------------
#module(load="imfile")
#input(type="imfile" File="/var/log/nginx/access.log" Tag="nginx-access" Severity="info" Facility="local0")
#input(type="imfile" File="/var/log/nginx/error.log"  Tag="nginx-error"  Severity="error" Facility="local0")
#:programname, startswith, "nginx" @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  Cluster logs (SynetoOS Edge / Kubernetes stack: containerd + kubelet)
#  Currently fall into the general journal / "messages" stream —
#  these two rules split them out so they can be shipped on their own.
# ---------------------------------------------------------------
#:programname, isequal, "containerd" @@<remote_syslog_ip>:514
#:programname, isequal, "kubelet" @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
#  messages (default/general log stream)
#  Everything not claimed by a category above — mirrors the local
#  catch-all rule in /etc/rsyslog.conf.
# ---------------------------------------------------------------
#*.info;mail.none;authpriv.none;cron.none @@<remote_syslog_ip>:514

# ---------------------------------------------------------------
# Notes:
#   - "@@" = TCP (recommended for reliability)
#   - "@"  = UDP (faster, not guaranteed)
#   - This file runs BEFORE syneto.conf, so any category you
#     enable here is forwarded before syneto.conf's local
#     "& stop" rules take effect.
#   - Enabling "cluster" (containerd/kubelet) and leaving
#     "messages" enabled too will double-ship those entries,
#     since they currently land in messages by default. Disable
#     one or the other if you don't want duplicates.
# ---------------------------------------------------------------

Save and EXIT

:wq

Step 4.  Validate rsyslog changes

rsyslogd -N1

Step 5.  Restart rsyslog

systemctl restart rsyslog

Step 6. Check rsyslog status

systemctl status rsyslog

EXAMPLE OUTPUT

rsyslogd: End of config validation run.

Step 7. Test Forwarding

logger "Forwarding test message from $(hostname)"

Confirm the message arrives on the collector. This only verifies categories covered by the messages catch-all or the "forward everything" rule — for nginx or cluster categories, trigger real activity (load the Web UI, or run a containerd/kubelet action) and check it shows up on the collector too.

Troubleshoot Forwarding Issues

Step 1. Inspects the rsyslog service's logs

journalctl -xeu rsyslog

Step 2. Test network reachability to the collector (replace <remote_syslog_ip> and <port> with the correct information)

nc -zv <remote_syslog_ip> <port>

• Confirm the collector is listening on the protocol/port you configured (TCP vs UDP, 514 or otherwise)
• Check local firewalls (firewalld, iptables) aren't blocking outbound traffic to the collector
• Make sure rsyslogd -N1 reports no syntax errors before restarting

NOTE
If nginx or cluster entries aren't arriving, verify the source is actually producing log lines (e.g. tail -f /var/log/nginx/access.log) and that the corresponding block in 10-forward.conf is uncommented

Summary

NOTE

• Admins can selectively forward Web, Audit, CLI, App, systemd, ESXi, nginx, cluster, and/or general messages logs to a remote collector over TCP or UDP, without modifying the Syneto-supported syneto.conf
• Categories can be toggled at any time by uncommenting or commenting their rule block and restarting rsyslog
• On HA pairs, apply the same file on both nodes