Linux binary forwarder

This is the recommended method for high-performance forwarding of standard syslog files on Linux. It uses the native forwarder binary and is the production-oriented path for long-running hosts.

When to use this

You want the dedicated Linux forwarder rather than the more general l24 CLI workflow.
You need reliable long-running forwarding managed by systemd.
You are forwarding standard log files such as /var/log/syslog or /var/log/daemon.log .

Install the binary

Choose an installation directory. The examples below assume /opt/logging24 .

mkdir -p /opt/logging24
cd /opt/logging24
wget -O forwarder 'https://logging24.com/forwarder/forwarder.debian-stable'
chmod +x forwarder

Any line shown with a leading shell prompt in the original guide is intended to be run in a Linux terminal.

Quickstart

Create one or more write tokens in the logging24 web UI, then run the forwarder with file paths and tokens.

cd /opt/logging24
./forwarder

The binary exposes the following subcommands:

help    - show help
version - show version
forward - forward logs to target endpoint

Forward live log files

./forwarder forward tail /var/log/syslog  \
                  tail /var/log/daemon.log  \
                  to ingest.logging24.com:9000

Use tail with regular files when possible. This lets the forwarder detect log rotation and resume cleanly when a logfile is replaced.

Forward streams or special files

For pipes, FIFOs, sockets, or test inputs, use stream instead of tail .

./forwarder forward stream some-test-logs.txt  \
                  timestamps first-iso \
                  prepend 'file:some-test-logs.txt ' \
                  to ingest.logging24.com:9000

Upload test logs

If you want to validate an existing logfile before switching production traffic, upload a sample file containing ISO-8601 timestamps. Fractional seconds are fine.

./forwarder stream some-test-logs.txt  \
            timestamps first-iso \
            prepend 'file:some-test-logs.txt ' \
            to ingest.logging24.com:9000

Use a separate write token for test uploads so those logs remain easy to isolate and expire later.

Run it as a systemd service

For continuous forwarding across reboots and power cycles, create a small run script and manage it with systemd.

1. Create a run script

cat > /opt/logging24/run
#!/bin/sh

exec ./forwarder forward \
  tail /var/log/syslog  \
  to ingest.logging24.com:9000

Then make it executable:

chmod +x /opt/logging24/run

2. Create the service unit

[Unit]
Description=logging24 Log Forwarding
Requires=network.target

[Service]
Type=exec
WorkingDirectory=/opt/logging24
ExecStart=/opt/logging24/run
TimeoutStopSec=60
Restart=always
RestartSec=10
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=logging24
User=root
CPUAccounting=on
CPUQuota=50%
MemoryAccounting=on
MemoryMin=64M
MemoryHigh=128M
MemoryMax=196M
IOAccounting=on
IOWeight=1

[Install]
WantedBy=multi-user.target

Save this as /etc/systemd/system/logging24.service , then reload, enable, and start it:

systemctl daemon-reload
systemctl enable logging24
systemctl start logging24

Library compatibility

If the default binary does not run on your system, use the bundled archive that includes the required libraries.

mkdir -p /opt/logging24
cd /opt
wget -O logging24/forwarder.tgz 'https://logging24.com/forwarder/forwarder.library-bundle.tgz'
tar -xzvf logging24/forwarder.tgz

This bundled binary must be run from the extracted directory because its library lookup paths are relative.

Operational notes

Files	Use `tail` for regular log files so the forwarder can track rotation correctly.
Streams	Use `stream` for pipes, FIFOs, sockets, or one-off test files instead of regular tailed logfiles.
Write tokens	Create separate write tokens when you want to isolate production traffic from test uploads.
Endpoint	The examples on this page target `ingest.logging24.com:9000` .