--- title: "Linux" slug: "linux" updated: 2025-07-06T20:28:23Z published: 2025-07-06T20:28:23Z canonical: "docs.databee.buzz/linux" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # Linux Linux is a family of open-source, Unix-like operating systems based on the Linux kernel. It is widely used in servers, desktops, embedded systems, and cloud environments due to its flexibility, stability, and security. A Linux OS machine refers to any computer or device running a [Linux-based operating system](https://www.linux.org/). **Integration Method:** Data Collector (syslog) **Tables**: Account Change (3001), Authentication (3002), Group Management (3006), SSH Activity (4007) This integration supports the following events. | **Event** | **Description** | | --- | --- | | Authentication logs | user authentication attempts, including successful logins, failed logins, user account changes etc., | This integration supports the following versions. | Linux Version Tested | Ubuntu 22.04 LTS, RHEL 8.8 | | --- | --- | | Data Collector API version | 0.6-62-d2aa70a | ## Prerequisites - The user should have a [compatible version](https://docs.databee.buzz/docs/data-collector#system-requirements) of the system in which the Data Collector is installed. For installation steps, please follow the steps mentioned [here](https://docs.databee.buzz/docs/data-collector#configure-data-collector-in-databee). - The user should have access to DataBee console. ## Configuration Overview ![A diagram of a computer network AI-generated content may be incorrect.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-723y7djp.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) **Client machine** – Machine in which end user activities are performed and those logs need to be processed in DataBee. **Data Collector** – This host has the DataBee Data Collector installed. It receives logs from client machines and forwards the events to DataBee via HTTPS. 1. [Configure syslog in Data Collector](/user-manual/docs/linux-data-collector-on-prem-latest#configure-syslog-on-data-collector) machine. 2. [Configure syslog on client](/user-manual/docs/linux-data-collector-on-prem-latest#configure-syslog-on-client-machines) machines. 3. [Configure Linux feed](/user-manual/docs/linux-data-collector-on-prem-latest#databee-configuration) in DataBee console. ## Configure syslog on Data Collector In this configuration, logs will be received from client machines on port 51442. Rsyslog is configured to forward all of it to port 51441. Those logs will be sent to DataBee via HTTPS. 1. Login to the Linux host machine. 2. Edit rsyslog.conf as a super user. Run the command **sudo nano /etc/rsyslog.conf** with admin privileges. 3. Enable following highlighted UDP lines with port that you want to expose to client machines to forward logs. *For e.g, port 51442 is opened here for clients to forward logs.* 4. Add **auth,authpriv.* @0.0.0.0:51441** at the end of the file to expose auth logs to 51441 port. This port will be used for Linux feed configuration in DataBee UI. 5. Save and close the file. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-lxg832xb.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) 6. Run the following command to restart syslog service **sudo service rsyslog restart**. ## Configure syslog on client machines 1. Login to Linux client machine from where you want to forward the authentication logs to DataBee. 2. Run command **sudo nano /etc/rsyslog.conf** with admin privileges. 3. Add **auth,authpriv.* @:51442** at the end of the file to send auth logs to Data Collector machine 51442 port. 4. Save and close the file. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-pm40z4hb.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) 5. Run the following command to restart syslog service **sudo service rsyslog restart**. ## DataBee Configuration 1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-psupvg87.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) 2. Search for the **Linux** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-cgy5hfda.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) 3. Click on the **Data Collector** for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-imy5r1m4.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) 4. Click on the **Syslog**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-f9s2mtl2.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) 5. Enter feed contact information and select data collector created from the previous step. 6. Click **Next.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-ecqiy4kl.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) 7. In the configuration page, confirm the following: - Select the mode as **UDP** from the dropdown. - Fill the port field with port configured during syslog configuration in host machine. - Click **Next.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-2pobxsbf.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) 8. If you don’t want to filter logs based on syslog messages from host/clients then click on **Submit**. - If you want to filter the message then click on **Add**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-88uz0rhi.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) - You will see filters dropdown with two options i.e., Inclusion and Exclusion 1. Inclusion: provide keywords that you want to apply on syslog messages to filter which need to be processed in DataBee. 2. Exclusion: provide keywords that you want to apply on syslog messages to filter which need not to be processed in DataBee. - Click on **Submit.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/linux---data-collector-on-prem-latest-image-bz2sup8r.png?sv=2026-02-06&spr=https&st=2026-10-30T01%3A55%3A09Z&se=2026-10-30T02%3A55%3A09Z&sr=c&sp=r&sig=rVquFVUsyGO4ust%2B3SWKftsYsLYc1r8HNgTdhC9c4%2B8%3D) ## Troubleshooting Tips - If you encounter any issues regarding log forwarding, refer to the [DataBee troubleshooting document](https://docs.databee.buzz/docs/troubleshooting) for detailed guidance. #