mbierman/addremotesyslog.sh

## addremotesyslog.sh
#!/bin/bash
# v 2.1.0

syslog=/etc/rsyslog.d/09-externalserver.conf
# this logs notice and above. use *.* log everything.
filter=*.notice
server=192.168.0.19 # Change the server to the IP of your syslog server.
port=514
hostname=firewalla
valid=$(grep "$server:$port" $syslog 2>/dev/null)

create () {
	# To use TCP uncomment line 13 to use TCP and comment line 15
	# echo -e "# remote syslog server (TCP):\n$filter @@$server:$port" | sudo tee $syslog
  # Line 15 assumes UDP: to use TCP, comment the line 15 and uncomment line 13
	echo -e "# remote syslog server (UDP):\n\$LocalHostName $hostname\nfilter @$server:$port" | sudo tee $syslog
        echo "Restarting rsyslog..."
        sudo systemctl restart rsyslog
        echo "remote syslog added"
	exit
}

cleanup () {
	sudo rm -f $syslog
	sudo systemctl restart rsyslog
}

if [ -f "$syslog" ] ; then

	if [ -n "$valid" ] ; then

	echo "remote syslog already in place with $server:$port specified"

	case $1 in
		-c)
		echo -e "\nrecreating syslog configuration..."
		cleanup
		create
		;;

  		-r|-restart|-force|-f)
                echo "Restarting rsyslog..."
                sudo systemctl restart rsyslog
		exit
		;;

		-u|-update)
			read -p "Are you sure you want to remove the syslog forwarder? type 'y' " -n 1 -r
			echo

			if [[ $REPLY =~ ^[Yy]$ ]] ; then
				ls $syslog 2>/dev/null && cleanup || echo -e "\n\nNo log found.\n"
			fi
			exit
		;;

		-h)
		echo -e "You can use:\n     - \`$0 -c\` recreate forwarding\n     - \`$0 -r\` restart the syslog service\
		\n     - \`$0 -u\` uninstall the settings to send to the remote syslog server\n\n"
    		exit
		;;
	esac

	else
		echo "The server is not configured correctly. On it."
		cleanup
		create
	fi
else
	echo "There was no syslog forwarder in place."
	create
fi
	#!/bin/bash
	# v 2.1.0

	syslog=/etc/rsyslog.d/09-externalserver.conf
	# this logs notice and above. use . log everything.
	filter=*.notice
	server=192.168.0.19 # Change the server to the IP of your syslog server.
	port=514
	hostname=firewalla
	valid=$(grep "$server:$port" $syslog 2>/dev/null)

	create () {
	# To use TCP uncomment line 13 to use TCP and comment line 15
	# echo -e "# remote syslog server (TCP):\n$filter @@$server:$port" \| sudo tee $syslog
	# Line 15 assumes UDP: to use TCP, comment the line 15 and uncomment line 13
	echo -e "# remote syslog server (UDP):\n\$LocalHostName $hostname\nfilter @$server:$port" \| sudo tee $syslog
	echo "Restarting rsyslog..."
	sudo systemctl restart rsyslog
	echo "remote syslog added"
	exit
	}

	cleanup () {
	sudo rm -f $syslog
	sudo systemctl restart rsyslog
	}

	if [ -f "$syslog" ] ; then

	if [ -n "$valid" ] ; then

	echo "remote syslog already in place with $server:$port specified"

	case $1 in
	-c)
	echo -e "\nrecreating syslog configuration..."
	cleanup
	create
	;;

	-r\|-restart\|-force\|-f)
	echo "Restarting rsyslog..."
	sudo systemctl restart rsyslog
	exit
	;;

	-u\|-update)
	read -p "Are you sure you want to remove the syslog forwarder? type 'y' " -n 1 -r
	echo

	if [[ $REPLY =~ ^[Yy]$ ]] ; then
	ls $syslog 2>/dev/null && cleanup \|\| echo -e "\n\nNo log found.\n"
	fi
	exit
	;;

	-h)
	echo -e "You can use:\n - \`$0 -c\` recreate forwarding\n - \`$0 -r\` restart the syslog service\
	\n - \`$0 -u\` uninstall the settings to send to the remote syslog server\n\n"
	exit
	;;
	esac

	else
	echo "The server is not configured correctly. On it."
	cleanup
	create
	fi
	else
	echo "There was no syslog forwarder in place."
	create
	fi