# Config RHEL8 rsyslog to send a copy of logs to graylog

**URL:** <https://community.graylog.org/t/config-rhel8-rsyslog-to-send-a-copy-of-logs-to-graylog/27397>\
**Category:** Graylog Central (peer support)\
**Created:** [January 22, 2023, 9:41pm UTC](https://community.graylog.org/t/config-rhel8-rsyslog-to-send-a-copy-of-logs-to-graylog/27397 "2023-01-22T21:41:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![goorooj](https://avatars.discourse-cdn.com/v4/letter/g/e9bcb4/32.png) [@goorooj](https://community.graylog.org/u/goorooj)\
**Post date:** [January 22, 2023, 9:41pm UTC](https://community.graylog.org/t/config-rhel8-rsyslog-to-send-a-copy-of-logs-to-graylog/27397/1 "2023-01-22T21:41:03Z")

</div>

Hi Forum,

i set up a graylog server, working probably fine. it still lacks logs that are sent to it, and there is my problem

i need to use the logs from the RHEL8 test machines to get useful output to convince people here to use graylog, but there are also the testers working constantly on this machines and needing them.  
so i tried to find a configuration for rsyslog where it does not just send the logs to a remote server, that is easy and 1000 times done… i want the logs to remain where they are and send a COPY to graylog.

i just cannot seem to find an answer to that, i have a feeling meanwhile rsyslog is not capable of that…  
or there is an elephant in the room that i dont see, so nobody mentions it thinking everybody would get that anyway.

can anybody give me an answer to that?

greetings  
alex

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [January 23, 2023, 2:23pm UTC](https://community.graylog.org/t/config-rhel8-rsyslog-to-send-a-copy-of-logs-to-graylog/27397/2 "2023-01-23T14:23:28Z")

</div>

The two people mostly use to copy to Graylog are [ElasticSearch Beats](https://www.elastic.co/beats/) or [NXlog](https://docs.nxlog.co/userguide/integrate/linux-logs.html) to ship pretty much anything you want into to Graylog. All the docs for that are right in those links. The nice thing about using them is you can manage consistent configurations of them via [Graylog’s Sidecar](https://go2docs.graylog.org/5-0/getting_in_log_data/graylog_sidecar.html)

Let us know what direction you go!

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [January 24, 2023, 2:32am UTC](https://community.graylog.org/t/config-rhel8-rsyslog-to-send-a-copy-of-logs-to-graylog/27397/3 "2023-01-24T02:32:01Z")

</div>

Hey @goorooj

I have to agree with @tmacgbay beeat /nxlog would be the way to go. For exeample on the nxlog tip i can route to two different servers,

Two inputs, notice the input names.

```auto
<Input stream-01>
    Module im_file
    FILE "/var/log/streams/*.json"
    SavePos TRUE
    ReadFromLast TRUE
    PollInterval 1
    #Exec $Message = $raw_event;
 </Input>
<Input stream-02>
    Module im_file
    FILE "/var/log/streams/*.json"
    SavePos TRUE
    ReadFromLast TRUE
    PollInterval 1
    #Exec $Message = $raw_event;
 </Input>

```

Two outputs

```auto
<Output pizza-hut>
    Module om_udp
    Host pizza-hut.com
    Port 51411    
</Output>

<Output papa-johns>
    Module om_udp
    Host papa-johns.com
    Port 51422    
</Output>

```

Now create you routes

```auto
<Route>
    Path stream-01 => pizza-hut
</Route>
<Route>
    Path stream-02 => papa-johns
</Route>

```

should be good.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 7, 2023, 2:32am UTC](https://community.graylog.org/t/config-rhel8-rsyslog-to-send-a-copy-of-logs-to-graylog/27397/4 "2023-02-07T02:32:45Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.