Specifics
- uses port 514 TCP and 514 UDP (default)
Installation
$ apt install rsyslog
Check that it is running
$ netstat -ano
Configure
vi /etc/rsyslog.conf
Disable/Enable by commenting out or uncommenting the modules imudp and intcp
# /etc/rsyslog.conf configuration file for rsyslog # # For more information install rsyslog-doc and see # /usr/share/doc/rsyslog-doc/html/configuration/index.html # # Default logging rules can be found in /etc/rsyslog.d/50-default.conf ################# #### MODULES #### ################# module(load="imuxsock") # provides support for local system logging #module(load="immark") # provides --MARK-- message capability # provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") # provides TCP syslog reception module(load="imtcp") input(type="imtcp" port="514")
This configuration file also allows you to specify where log types go...
<MORE TO COME>
Forward logs to another service
*.* @127.0.0.1:514
Testing Rsyslog
To listen on a port:
Figure out your interface
$ ifconfig
docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
inet6 fe80::42:d5ff:fe84:1047 prefixlen 64 scopeid 0x20<link>
ether 02:42:d5:84:10:47 txqueuelen 0 (Ethernet)
RX packets 56436034 bytes 78842926492 (78.8 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 73681312 bytes 26355844162 (26.3 GB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
enp0s25: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.1.50 netmask 255.255.255.0 broadcast 192.168.1.255
inet6 fe80::6e3b:e5ff:fe41:582b prefixlen 64 scopeid 0x20<link>
ether 6c:3b:e5:41:58:2b txqueuelen 1000 (Ethernet)
RX packets 123047743 bytes 50439393846 (50.4 GB)
RX errors 0 dropped 451010 overruns 0 frame 0
TX packets 142608496 bytes 115546425420 (115.5 GB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 20 memory 0xf7f00000-f7f20000
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 2350821 bytes 433332792 (433.3 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2350821 bytes 433332792 (433.3 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
...
$ tcpdump -i enp0s25 port 514
If you have syslog running in a docker container on your would use the following command to see the data
$ tcpdump -i docker0 port 514 13:24:44.758302 IP deepthought.57574 > 172.17.0.16.syslog: SYSLOG user.notice, length: 123
Send a log entry
$ logger --server localhost --port 514 "this is a test"
Start and Stopping the RSyslogd Service
Get Status
$ systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; disabled; vendor preset: enabled)
Active: active (running) since Thu 2021-07-22 13:34:41 EDT; 15s ago
Docs: man:rsyslogd(8)
https://www.rsyslog.com/doc/
Main PID: 305322 (rsyslogd)
Tasks: 10 (limit: 19045)
Memory: 6.3M
CGroup: /system.slice/rsyslog.service
└─305322 /usr/sbin/rsyslogd -n -iNONE
Jul 22 13:34:41 deepthought systemd[1]: Starting System Logging Service...
Jul 22 13:34:41 deepthought systemd[1]: Started System Logging Service.
Jul 22 13:34:41 deepthought rsyslogd[305322]: rsyslogd's groupid changed to 110
Jul 22 13:34:41 deepthought rsyslogd[305322]: rsyslogd's userid changed to 104
Jul 22 13:34:41 deepthought rsyslogd[305322]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="305322" x-info="https://www.rsyslog.c>
Restart
$ systemctl restart rsyslog
Forwarding to Elasticsearch
Install rsyslog-elasticsearch
$ apt-get install rsyslog-elasticsearch
Add config file for elasticsearch
$ vi /etc/rsyslog.d/10-rsyslog-elasticsearch.conf
module(load="omelasticsearch") # for outputting to Elasticsearch
# this is for index names to be like: logstash-YYYY.MM.wWW (where WW is the week number)
template(name="logstash-index"
type="list") {
constant(value="logstash-")
property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
constant(value=".")
property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
constant(value=".w")
# here we use the week number to avoid creating lots of shards on Elasticsearch
property(name="timereported" dateFormat="week")
}
# permits to have the part after `/` in programname
global(parser.permitSlashInProgramName="on")
# this is for formatting our syslog in JSON with @timestamp
template(name="plain-syslog"
type="list") {
constant(value="{")
constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
constant(value="\",\"host\":\"") property(name="hostname")
constant(value="\",\"severity\":\"") property(name="syslogseverity-text")
constant(value="\",\"facility\":\"") property(name="syslogfacility-text")
constant(value="\",\"programname\":\"") property(name="programname" format="json")
constant(value="\",\"procid\":\"") property(name="procid" format="json")
constant(value="\",\"message\":\"") property(name="msg" format="json")
constant(value="\"}")
}
# this is where we actually send the logs to Elasticsearch
action(server="127.0.0.1"
serverport="9200"
usehttps="off"
type="omelasticsearch"
template="plain-syslog"
errorfile="/tmp/rsyslog-elasticsearch-error.log"
searchIndex="logstash-index"
dynSearchIndex="on")
Restart
$ systemctl restart rsyslog
Check Status
$ systemctl status rsyslog