# PVE 發送syslog到遠端伺服器

##### <span style="color: rgb(0, 0, 0);">**運行環境**</span>

- <span style="color: rgb(0, 0, 0);">**PVE 8.2**</span>

##### <span style="color: rgb(0, 0, 0);">**設定rsyslog**</span>  


<span style="color: rgb(0, 0, 0);">**由於PVE已改成`systemd-journald`簡化日誌架構，需啟用轉發到Syslog並安裝rsyslog傳送log到遠端**</span>

<span style="color: rgb(0, 0, 0);">**編輯`/etc/systemd/journald.conf`**</span>

```
ForwardToSyslog=yes
```

<span style="color: rgb(0, 0, 0);">**安裝rsyslog**</span>

```
apt install rsyslog
```

<span style="color: rgb(0, 0, 0);">**新增`/etc/rsyslog.d/remotelog.conf`**</span>

<span style="color: rgb(0, 0, 0);">**傳送所有log**</span>

```
*.* @remoteip:516
```

<span style="color: rgb(0, 0, 0);">**篩選log，範例為篩選sshd程式訊息包含pam\_unix則傳送**</span>

```
if ($programname == "sshd" and $msg contains "pam_unix") then {
    action(type="omfwd" target="remoteip" port="516")
    stop
}
```

<span style="color: rgb(0, 0, 0);">**重啟系統服務**</span>

```
systemctl enable rsyslog
systemctl restart rsyslog

systemctl restart systemd-journald
```

##### <span style="color: rgb(0, 0, 0);">**測試**</span>

<span style="color: rgb(0, 0, 0);">**使用Synology日誌接收，確認有PVE的log**</span>

<span style="color: rgb(0, 0, 0);">[![image.png](https://note.homesitetw.com/uploads/images/gallery/2025-10/scaled-1680-/wy7image.png)](https://note.homesitetw.com/uploads/images/gallery/2025-10/wy7image.png)</span>