The syslog daemon, running on SecurePlatform OS (and most Linux based OS's) handles most of the Operating System logging. This daemon uses the /etc/syslog.conf file for configuration and handles all messages sent to it on UDP 0.0.0.0:514

Based on syslog message facility and priority, the syslog.conf file defines how each syslog message is handled, then determines where this message is written locally or to what remote IP address it should be sent.

Name	Facility
kern	Kernel
user	Regular user processes
mail	Mail system
lpr	Line printer system
auth (authpriv)	Authorization system, or programs that ask for user names and passwords (login, su, getty, ftpd, etc.)
daemon	Other system daemons
news	News subsystem
uucp	UUCP subsystem
local0... local7	Reserved for site-specific use

 

Priority	Meaning
emerg	Emergency condition, such as an imminent system crash, usually broadcast to all users
alert	Condition that should be corrected immediately, such as a corrupted system database
crit	Critical condition, such as a hardware error
err	Ordinary error
warning	Warning
notice	Condition that is not an error, but possibly should be handled in a special way
info	Informational message
debug	Messages that are used when debugging programs
none	Do not send messages from the indicated facility to the selected file.

 

Example 1:

authpriv.* <TAB> /var/log/secure

"authpriv" is the facility. 
"." - delimits the facility from the priority.
"*" - means all priorities.
There must be a <TAB> between the selector section (facility.priority) and the action section on each line.
"/var/log/secure" is the file that the messages are written to.

 

 

Example 2:

*.info;authpriv.none;cron.none;local5.none <TAB> @10.0.0.1

The selector section states, all facilities (except authpriv, cron and local5) with a priority of at least info or higher.
Send them via UDP:514 to IP address 10.0.0.1.

If you want to send syslogs to multiple servers, repeat the command from Example 2 to a different server.


Note:
When defining the priority, it will include the defined level and anything higher. Number of lines does not matter, each message is processed by each line separately.
Any time a change is made to the /etc/syslog.conf file, the syslog daemon should be restarted. To do so, run the service syslog restart command.
A Security rule to allow a syslog traffic to pass to/from the server may be required.