---
name: cloud-logs-agent-rsyslog
title: Configuring the Logging agent for Rsyslog logs
description: You can deploy a Logging agent to collect and route Rsyslog messages from a Syslog server to an IBM Cloud Logs instance.
last-updated: 2025-02-17
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cloud-logs?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Configuring the Logging agent for Rsyslog logs
{: #agent-rsyslog}

You can deploy a Logging agent to collect and route Rsyslog messages from a Syslog server to an IBM Cloud Logs instance.
{: shortdesc}



## Before you begin
{: #syslog-prereq}

Be sure that you have deployed the Logging agent on Linux.
For more information, see [Managing the agent Linux environments](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-agent-linux&format=markdown).


## Step 1. Setting up the Logging agent configuration
{: #syslog-s1}

You can configure the Logging agent to collect Rsyslog messages through a Unix socket server (UDP or TCP) or over the network using TCP or UDP.

1. Edit the `fluent-bit.conf` file in the `/etc/fluent-bit/` folder.

2. Choose the type of configuration for the agent to collect the Syslog messages. Add the following input sections:

   - To listen for Syslog messages on the Unix socket

     ```yaml

     [INPUT]
         Name                syslog
         Path                /tmp/in_syslog
         Buffer_Chunk_Size   32000
         Buffer_Max_Size     64000
         Receive_Buffer_Size 512000
      ```
     {: codeblock}

   - To listen for Syslog messages on the Network mode over TCP

     ```yaml

     [INPUT]
         Name     syslog
         Parser   syslog-rfc3164
         Listen   0.0.0.0
         Port     5140
         Mode     tcp

     ```
    {: codeblock}


   - To listen for Syslog messages on the Unix socket mode over UDP

     ```yaml

     [INPUT]
         Name      syslog
         Parser    syslog-rfc3164
         Path      /tmp/fluent-bit.sock
         Mode      unix_udp
         Unix_Perm 0644

     ```
    {: codeblock}

## Step 2. Stop and start the agent
{: #syslog-s2}

Run the following commands.

```sh
systemctl daemon-reload
```
{: pre}

```sh
systemctl restart fluent-bit
```
{: pre}

Run the following command to start the agent if you want to receive the Syslog messages from localhost in TCP mode.

```sh
<FLUENT-BIT-INSTALL-DIR>/bin/fluent-bit -c /etc/fluent-bit/fluent-bit.conf
```
{: pre}

## Step 3. Verify that logs are being delivered to your target destination
{: #syslog-s3}

Complete the following steps depending on your target type.

1. [Go to the web UI for your IBM Cloud Logs instance.](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-instance-launch&format=markdown)

2. When your agent is correctly configured, you can see logs through the default dashboard view.