# Sending Bro Logs to a Remote Syslog Server

**URL:** <https://community.zeek.org/t/sending-bro-logs-to-a-remote-syslog-server/4569>\
**Category:** Zeek\
**Created:** [December 29, 2016, 2:58am UTC](https://community.zeek.org/t/sending-bro-logs-to-a-remote-syslog-server/4569 "2016-12-29T02:58:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michelle\_Crawley](https://avatars.discourse-cdn.com/v4/letter/m/7cd45c/32.png) [@Michelle\_Crawley](https://community.zeek.org/u/Michelle_Crawley)\
**Post date:** [December 29, 2016, 2:58am UTC](https://community.zeek.org/t/sending-bro-logs-to-a-remote-syslog-server/4569/1 "2016-12-29T02:58:03Z")

</div>

Hello,

I am very new to Bro. I have an external Syslog server in my environment that I am trying to send logs to from Bro. I have been searching everywhere and following different tutorials/hints, but I am still having no luck. How should I go about doing this?

Thanks,  
Michelle

---

<div class="post-metadata">

**Author:** ![Carl\_Forsythe](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@Carl\_Forsythe](https://community.zeek.org/u/Carl_Forsythe)\
**Post date:** [December 29, 2016, 7:06am UTC](https://community.zeek.org/t/sending-bro-logs-to-a-remote-syslog-server/4569/2 "2016-12-29T07:06:58Z")

</div>

The easiest way I’ve found to date is to use rsyslog to pick them up off the file system.

A good template/starting point can be found at [https://github.com/lruppert/bro-scripts/blob/master/rsyslog/bro-ids.conf](https://github.com/lruppert/bro-scripts/blob/master/rsyslog/bro-ids.conf)

Hope this helps.

-Carl

---

<div class="post-metadata">

**Author:** ![David\_Hoelzer](https://avatars.discourse-cdn.com/v4/letter/d/2acd7d/32.png) [@David\_Hoelzer](https://community.zeek.org/u/David_Hoelzer)\
**Post date:** [December 29, 2016, 10:36am UTC](https://community.zeek.org/t/sending-bro-logs-to-a-remote-syslog-server/4569/3 "2016-12-29T10:36:32Z")

</div>

rsyslogd forwarding the logs with file monitoring.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/sending-bro-logs-to-a-remote-syslog-server/4569/4 "2022-05-06T15:44:26Z")

</div>