How to Configure Remote rsyslog with TLS and Plain TCP

Updated: 28 September 2026 · Applies to: rsyslog 8.23 to 8.25 with rsyslog-gnutls on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

Logs sent over the network in plain text can be read and altered on the way. rsyslog can encrypt them with TLS. This guide sets up a log server that accepts encrypted logs on port 6514 and, at the same time, plain TCP on port 514 for devices that cannot do TLS. We tested the whole setup on AlmaLinux 9 with rsyslog 8.2510: a plain message on 514, a TLS message on 6514, and a forwarding client that checks the server's certificate all arrived.

1. Install the TLS module on server and clients

dnf install rsyslog-gnutls     # AlmaLinux, Rocky Linux, RHEL
apt install rsyslog-gnutls     # Ubuntu, Debian

2. Certificates

You need a CA certificate that clients trust and a certificate for the server whose name matches the host name clients connect to. For an internal setup you can create your own CA:

mkdir -p /etc/pki/rsyslog && cd /etc/pki/rsyslog
openssl req -x509 -newkey rsa:3072 -nodes -days 3650 -subj "/CN=Log CA" -keyout ca-key.pem -out ca.pem
openssl req -newkey rsa:3072 -nodes -subj "/CN=logs.example.lan" -keyout server-key.pem -out server.csr
openssl x509 -req -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -days 825 -out server-cert.pem
chmod 600 *-key.pem

Keep ca-key.pem safe, and copy only ca.pem to the clients.

3. Server configuration

Create /etc/rsyslog.d/10-log-server.conf:

global(
  DefaultNetstreamDriverCAFile="/etc/pki/rsyslog/ca.pem"
  DefaultNetstreamDriverCertFile="/etc/pki/rsyslog/server-cert.pem"
  DefaultNetstreamDriverKeyFile="/etc/pki/rsyslog/server-key.pem"
)
module(load="imtcp")
input(type="imtcp" port="514" ruleset="remote")
input(type="imtcp" port="6514" ruleset="remote"
      StreamDriver.Name="gtls" StreamDriver.Mode="1" StreamDriver.AuthMode="anon")
template(name="PerHost" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
ruleset(name="remote") {
    action(type="omfile" dynaFile="PerHost")
    stop
}

Port 514 stays unencrypted; port 6514 requires TLS. AuthMode="anon" encrypts without asking clients for certificates; for mutual authentication, give clients their own certificates and use x509/name with StreamDriver.PermittedPeers. Remove the port 514 input if all your clients support TLS.

Check and restart: rsyslogd -N1 && systemctl restart rsyslog. On AlmaLinux, Rocky Linux and RHEL, SELinux already allows rsyslog on TCP port 6514; for TCP 514, see the note in how to send logs to a remote server. Open both ports in the firewall for your own networks only.

4. Client configuration

Copy ca.pem to /etc/pki/rsyslog/ca.pem on the client and create /etc/rsyslog.d/90-forward-tls.conf:

global(DefaultNetstreamDriverCAFile="/etc/pki/rsyslog/ca.pem")
*.* action(type="omfwd" target="logs.example.lan" port="6514" protocol="tcp"
           StreamDriver="gtls" StreamDriverMode="1"
           StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="logs.example.lan"
           queue.type="LinkedList" queue.filename="fwdtls" queue.saveOnShutdown="on"
           action.resumeRetryCount="-1")

x509/name makes the client check that the server's certificate is signed by your CA and carries the expected name, so logs cannot be sent to an impostor. Restart rsyslog and test with logger "tls test".

Common problems

• "certificate validation failed" or "peer name not authorized" in the client's journal: the name in StreamDriverPermittedPeers differs from the certificate's CN, or the client does not have the right ca.pem.
• "gtls: could not load module": the rsyslog-gnutls package is missing.
• Nothing arrives on 6514: test the TLS handshake with openssl s_client -connect logs.example.lan:6514.

Official documentation: rsyslog TLS guide and imtcp module.