How to Forward JumpServer Logs to a Remote Syslog Server (v4.10.7 Docker Setup)

Sending JumpServer Logs to a Remote Syslog Server (Tested on v4.10.7)

JumpServer is a great open-source b.astion host solution for managing and auditing access to your infrastructure. In production environments, however, it’s crucial to centralize your logs — and that means forwarding them to a remote syslog server like rsyslog, Graylog, or a SIEM.

In this post, I’ll show you how I configured JumpServer (v4.10.7) to send logs to a remote syslog server, based on real hands-on experience. I’ll also reference a GitHub issue that helped guide this process.

Goal

Enable JumpServer (v4.10.7) Docker containers to send logs to a remote syslog server at IP: 172.22.196.187, port 514/UDP.

Environment

• OS: Kali Linux WSL (any Linux with Docker will work)
• JumpServer version: v4.10.7
• Installation path: /opt/jumpserver-installer-v4.10.7/
• Syslog server: rsyslog listening on UDP port 514

Step-by-Step Configuration

Step 1: Ensure rsyslog is Installed

If your remote (or local) log collector is not already running rsyslog, install it.

On Debian/Ubuntu:

sudo apt update
sudo apt install rsyslog -y

On RHEL/CentOS:

sudo yum install rsyslog -y

Then ensure the service is running and listening on UDP port 514:

sudo systemctl enable rsyslog
sudo systemctl start rsyslog

Check with:

sudo netstat -ulnp | grep :514
# or
sudo ss -ulnp | grep :514

You should see output similar to:

udp        0      0 0.0.0.0:514             0.0.0.0:*    121/rsyslogd
udp6       0      0 :::514                  :::*         121/rsyslogd

If you do not see this, your rsyslog config may not be accepting logs via UDP. You can enable this by editing:

sudo nano /etc/rsyslog.conf

Uncomment or add:

module(load="imudp")
input(type="imudp" port="514")

Then restart:

sudo systemctl restart rsyslog

1. Ensure Syslog Server is Running & Accessible

Check that rsyslog is listening on UDP port 514:

sudo netstat -ulnp | grep :514

Or using ss:

sudo ss -ulnp | grep :514

Expected output:

udp        0      0 0.0.0.0:514     0.0.0.0:*     users:(("rsyslogd",pid=121,fd=6))
udp6       0      0 :::514          :::*         users:(("rsyslogd",pid=121,fd=7))

Also verify that 172.22.196.187 is reachable from the Docker host:

ping 172.22.196.187

2. Add Syslog Environment Variables to Docker Compose Files

Navigate to the Docker Compose directory:

cd /opt/jumpserver-installer-v4.10.7/compose

Inside each service’s YAML file (e.g. core.yml, web.yml, lion.yml, etc.), add the following environment variables under the corresponding service definition:

environment:
  - SYSLOG_ENABLE=true
  - SYSLOG_ADDR=172.22.196.187:514
  - SYSLOG_FACILITY=local2

If the service already has an environment: section, just append the 3 lines. If not, add a new environment: block.

Apply this to all relevant files under /compose, such as:

• core.yml
• web.yml
• lion.yml
• chen.yml
• receptor.yml
• facelive.yml
• video-worker.yml
• xrdp.yml
• etc.

3. Restart JumpServer Stack

Once all edits are done, restart JumpServer:

./jmsctl.sh restart

Or, if you’re using Docker Compose directly:

docker compose -f compose/<service>.yml down
docker compose -f compose/<service>.yml up -d

4. Validate Logs Are Being Forwarded

From Docker Side

Use docker logs to check if the containers start without errors:

docker logs jms_core
docker logs jms_web

From Syslog Server Side

On the syslog server (172.22.196.187), check the logs:

tail -f /var/log/syslog
# or
journalctl -u rsyslog

You should start seeing logs tagged with local2 (or whichever SYSLOG_FACILITY you configured).

TL;DR Add SYSLOG_ENABLE, SYSLOG_ADDR, and SYSLOG_FACILITY to each JumpServer Docker service’s environment config. Point to your rsyslog server IP:514/UDP, restart containers, and check logs are forwarded successfully.

Reference

This approach was inspired by community discussion in:

**GitHub Issue #14847 — JumpServer Syslog Support**

It confirmed that SYSLOG_ENABLE, SYSLOG_ADDR, and SYSLOG_FACILITY are respected by JumpServer’s Docker images.

✅ Final Thoughts

This setup is essential for production deployments where log centralization and auditability are critical. With syslog support, JumpServer can seamlessly integrate with your existing log monitoring infrastructure — from ELK/EFK stacks to SIEMs like Splunk or Graylog.