Project

General

Profile

Syslog server » History » Version 2

Charles Atkinson, 30/07/2020 15:06
Updated for %FROMHOST% instead of %HOSTNAME% in 10-templates.conf

1 1 Charles Atkinson
h1. syslog (rsyslog) server implementation
2 1 Charles Atkinson
3 1 Charles Atkinson
{{toc}}
4 1 Charles Atkinson
5 1 Charles Atkinson
h1. Introduction
6 1 Charles Atkinson
7 1 Charles Atkinson
This page documents a syslog (rsyslog) server implementation that results in:
8 2 Charles Atkinson
* Each client having its own /srv/syslog/<FQDN> directory, including clients that identify themselves by bare hostname or by IP address
9 2 Charles Atkinson
* The files in that directory being named as they were on the client
10 1 Charles Atkinson
* Three year retention
11 1 Charles Atkinson
12 1 Charles Atkinson
h2. Related documents
13 1 Charles Atkinson
14 1 Charles Atkinson
None
15 1 Charles Atkinson
16 1 Charles Atkinson
h1. Server
17 1 Charles Atkinson
18 1 Charles Atkinson
h2. Directories and files
19 1 Charles Atkinson
20 1 Charles Atkinson
|_.Directory or file |_.Usage |
21 1 Charles Atkinson
|/etc/logrotate.d/rsyslog-imudp |Rotates /srv/syslog/<FQDN>/* log files |
22 1 Charles Atkinson
|/etc/rsyslog.conf |Primary configuration file; as installed by package |
23 1 Charles Atkinson
|/etc/rsyslog.d/00-modules.conf |Load and configure rsyslog modules imudp (input messages by UDP) and builtin:omfile (output files)|
24 1 Charles Atkinson
|/etc/rsyslog.d/10-FileFormat.template.conf |Similar to the version on all servers|
25 1 Charles Atkinson
|/etc/rsyslog.d/10-templates.conf |Sets /srv/syslog/<FQDN>/<log name> paths and sets same message format as 10-FileFormat.template.conf |
26 1 Charles Atkinson
|/etc/rsyslog.d/20-rulesets.conf |Equivalent to rsyslog.conf's rules; directs clients messages to individual /srv/syslog/<FQDN>/<log name> files.  Associates the rules with module imudp |
27 1 Charles Atkinson
|/etc/rsyslog.d/debug.conf.disabled |When .disabled removed, configures debug logging |
28 1 Charles Atkinson
|/etc/rsyslog.d/postfix.conf |Installed by the postfix package |
29 1 Charles Atkinson
|/srv/syslog/<FQDN>/ |Directory for all logs from a client |
30 1 Charles Atkinson
|/var/log/* |Local log files, same as on all servers |
31 1 Charles Atkinson
32 1 Charles Atkinson
/etc/logrotate.d/rsyslog-imudp
33 1 Charles Atkinson
<pre>
34 1 Charles Atkinson
# Rotation for logs created by the rsyslog configuration for imudp
35 1 Charles Atkinson
36 1 Charles Atkinson
/srv/syslog/*/syslog
37 1 Charles Atkinson
{
38 1 Charles Atkinson
    daily
39 1 Charles Atkinson
    rotate 731
40 1 Charles Atkinson
    dateext
41 1 Charles Atkinson
    dateyesterday
42 1 Charles Atkinson
    missingok
43 1 Charles Atkinson
    notifempty
44 1 Charles Atkinson
    delaycompress
45 1 Charles Atkinson
    compress
46 1 Charles Atkinson
    postrotate
47 1 Charles Atkinson
        invoke-rc.d rsyslog rotate > /dev/null
48 1 Charles Atkinson
    endscript
49 1 Charles Atkinson
}
50 1 Charles Atkinson
51 1 Charles Atkinson
/srv/syslog/*/mail.info
52 1 Charles Atkinson
/srv/syslog/*/mail.warn
53 1 Charles Atkinson
/srv/syslog/*/mail.err
54 1 Charles Atkinson
/srv/syslog/*/mail.log
55 1 Charles Atkinson
/srv/syslog/*/daemon.log
56 1 Charles Atkinson
/srv/syslog/*/kern.log
57 1 Charles Atkinson
/srv/syslog/*/auth.log
58 1 Charles Atkinson
/srv/syslog/*/user.log
59 1 Charles Atkinson
/srv/syslog/*/lpr.log
60 1 Charles Atkinson
/srv/syslog/*/cron.log
61 1 Charles Atkinson
/srv/syslog/*/debug
62 1 Charles Atkinson
/srv/syslog/*/messages
63 1 Charles Atkinson
{
64 1 Charles Atkinson
    weekly
65 1 Charles Atkinson
    rotate 109
66 1 Charles Atkinson
    dateext
67 1 Charles Atkinson
    dateyesterday
68 1 Charles Atkinson
    missingok
69 1 Charles Atkinson
    notifempty
70 1 Charles Atkinson
    compress
71 1 Charles Atkinson
    delaycompress
72 1 Charles Atkinson
    sharedscripts
73 1 Charles Atkinson
    postrotate
74 1 Charles Atkinson
        invoke-rc.d rsyslog rotate > /dev/null
75 1 Charles Atkinson
    endscript
76 1 Charles Atkinson
}
77 1 Charles Atkinson
</pre>
78 1 Charles Atkinson
/etc/rsyslog.d/00-modules.conf
79 1 Charles Atkinson
<pre>
80 1 Charles Atkinson
# rsyslog config fragment for module customisation
81 1 Charles Atkinson
82 1 Charles Atkinson
# provides UDP syslog reception
83 1 Charles Atkinson
module(load="imudp")
84 1 Charles Atkinson
input(type="imudp" port="514")
85 1 Charles Atkinson
86 1 Charles Atkinson
# Change omfile's default parameters (so they do not have to be set in every action)
87 1 Charles Atkinson
# Note: setting template MyMsgFormat here was not effective
88 1 Charles Atkinson
module(
89 1 Charles Atkinson
    load="builtin:omfile"
90 1 Charles Atkinson
    dirCreateMode="0750"
91 1 Charles Atkinson
    dirGroup="adm"
92 1 Charles Atkinson
    dirOwner="root"
93 1 Charles Atkinson
    fileCreateMode="0640"
94 1 Charles Atkinson
    fileGroup="adm"
95 1 Charles Atkinson
    fileOwner="root"
96 1 Charles Atkinson
)
97 1 Charles Atkinson
</pre>/etc/rsyslog.d/10-templates.conf
98 1 Charles Atkinson
<pre>
99 1 Charles Atkinson
# rsyslog config fragment for custom templates
100 1 Charles Atkinson
101 1 Charles Atkinson
# Log file paths
102 2 Charles Atkinson
template (name="AuthLog"   type="string" string="/srv/syslog/%FROMHOST%/auth.log")
103 2 Charles Atkinson
template (name="DaemonLog" type="string" string="/srv/syslog/%FROMHOST%/daemon.log")
104 2 Charles Atkinson
template (name="DebugLog"  type="string" string="/srv/syslog/%FROMHOST%/debug.log")
105 2 Charles Atkinson
template (name="KernLog"   type="string" string="/srv/syslog/%FROMHOST%/kern.log")
106 2 Charles Atkinson
template (name="MailError" type="string" string="/srv/syslog/%FROMHOST%/mail.error")
107 2 Charles Atkinson
template (name="MailInfo"  type="string" string="/srv/syslog/%FROMHOST%/mail.info")
108 2 Charles Atkinson
template (name="MailLog"   type="string" string="/srv/syslog/%FROMHOST%/mail.log")
109 2 Charles Atkinson
template (name="MailWarn"  type="string" string="/srv/syslog/%FROMHOST%/mail.warn")
110 2 Charles Atkinson
template (name="Messages"  type="string" string="/srv/syslog/%FROMHOST%/messages")
111 2 Charles Atkinson
template (name="Syslog"    type="string" string="/srv/syslog/%FROMHOST%/syslog")
112 2 Charles Atkinson
template (name="UserLog"   type="string" string="/srv/syslog/%FROMHOST%/user.log")
113 1 Charles Atkinson
114 1 Charles Atkinson
# Message format
115 1 Charles Atkinson
template (name="MyMsgFormat" type="string"
116 1 Charles Atkinson
    string="%TIMESTAMP% %HOSTNAME:R,BRE,0,FIELD:^[^.]*\\.[^.]*--end:% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
117 1 Charles Atkinson
)
118 2 Charles Atkinson
</pre>Note: <notextile>%FROMHOST%</notextile> is required as shown above to support clients that identify themselves by bare hostname or by IP address logging to their own own /srv/syslog/<FQDN> directories.  It requires DNS reverse lookup.  In case DNS reverse lookup is not available, <notextile>%FROMHOST%</notextile> should be replaced by <notextile>%HOSTNAME%</notextile>.
119 2 Charles Atkinson
120 2 Charles Atkinson
/etc/rsyslog.d/20-rulesets.conf
121 1 Charles Atkinson
<pre>
122 1 Charles Atkinson
# rsyslog config fragment for custom rulesets
123 1 Charles Atkinson
124 1 Charles Atkinson
# Ruleset based on package's rsyslog.conf's rules for local messages
125 1 Charles Atkinson
ruleset(name="imudp"){
126 1 Charles Atkinson
    auth,authpriv.*             action(type="omfile" dynaFile="AuthLog"   template="MyMsgFormat")
127 1 Charles Atkinson
    *.*;auth,authpriv.none      action(type="omfile" dynaFile="Syslog"    template="MyMsgFormat")
128 1 Charles Atkinson
    daemon.*                    action(type="omfile" dynaFile="DaemonLog" template="MyMsgFormat")
129 1 Charles Atkinson
    kern.*                      action(type="omfile" dynaFile="KernLog"   template="MyMsgFormat")
130 1 Charles Atkinson
    mail.*                      action(type="omfile" dynaFile="MailLog"   template="MyMsgFormat")
131 1 Charles Atkinson
    user.*                      action(type="omfile" dynaFile="UserLog"   template="MyMsgFormat")
132 1 Charles Atkinson
    mail.info                   action(type="omfile" dynaFile="MailInfo"  template="MyMsgFormat")
133 1 Charles Atkinson
    mail.warn                   action(type="omfile" dynaFile="MailWarn"  template="MyMsgFormat")
134 1 Charles Atkinson
    mail.err                    action(type="omfile" dynaFile="MailError" template="MyMsgFormat")
135 1 Charles Atkinson
    *.=debug;\
136 1 Charles Atkinson
        auth,authpriv.none;\
137 1 Charles Atkinson
        news.none;mail.none     action(type="omfile" dynaFile="DebugLog"  template="MyMsgFormat")
138 1 Charles Atkinson
    *.=info;*.=notice;*.=warn;\
139 1 Charles Atkinson
        auth,authpriv.none;\
140 1 Charles Atkinson
        cron,daemon.none;\
141 1 Charles Atkinson
        mail,news.none          action(type="omfile" dynaFile="Messages"  template="MyMsgFormat")
142 1 Charles Atkinson
}
143 1 Charles Atkinson
144 1 Charles Atkinson
# Use the ruleset to input module for UPD
145 1 Charles Atkinson
input(type="imudp" port="514" ruleset="imudp")
146 1 Charles Atkinson
</pre>/etc/rsyslog.d/debug.conf.disabled
147 1 Charles Atkinson
<pre>
148 1 Charles Atkinson
$DebugFile /var/log/rsyslog-debug.log
149 1 Charles Atkinson
$DebugLevel 2
150 1 Charles Atkinson
</pre>
151 1 Charles Atkinson
152 1 Charles Atkinson
h1. Clients
153 1 Charles Atkinson
154 1 Charles Atkinson
h2. Debian computers
155 1 Charles Atkinson
156 1 Charles Atkinson
/etc/rsyslog.d/00-rsyslog-server.conf
157 1 Charles Atkinson
<pre>
158 1 Charles Atkinson
# Format all messages with hostname as FQDN and send to <syslog server FQDN>
159 1 Charles Atkinson
160 1 Charles Atkinson
$PreserveFQDN on
161 1 Charles Atkinson
*.* @<syslog server FQDN>
162 1 Charles Atkinson
</pre>/etc/logrotate.d/rsyslog (as installed by package except for dateext and dateyesterday
163 1 Charles Atkinson
<pre>
164 1 Charles Atkinson
/var/log/syslog
165 1 Charles Atkinson
{
166 1 Charles Atkinson
	rotate 7
167 1 Charles Atkinson
	daily
168 1 Charles Atkinson
	dateext
169 1 Charles Atkinson
	dateyesterday
170 1 Charles Atkinson
	missingok
171 1 Charles Atkinson
	notifempty
172 1 Charles Atkinson
	delaycompress
173 1 Charles Atkinson
	compress
174 1 Charles Atkinson
	postrotate
175 1 Charles Atkinson
		invoke-rc.d rsyslog rotate > /dev/null
176 1 Charles Atkinson
	endscript
177 1 Charles Atkinson
}
178 1 Charles Atkinson
179 1 Charles Atkinson
/var/log/mail.info
180 1 Charles Atkinson
/var/log/mail.warn
181 1 Charles Atkinson
/var/log/mail.err
182 1 Charles Atkinson
/var/log/mail.log
183 1 Charles Atkinson
/var/log/daemon.log
184 1 Charles Atkinson
/var/log/kern.log
185 1 Charles Atkinson
/var/log/auth.log
186 1 Charles Atkinson
/var/log/user.log
187 1 Charles Atkinson
/var/log/lpr.log
188 1 Charles Atkinson
/var/log/cron.log
189 1 Charles Atkinson
/var/log/debug
190 1 Charles Atkinson
/var/log/messages
191 1 Charles Atkinson
{
192 1 Charles Atkinson
	rotate 4
193 1 Charles Atkinson
	weekly
194 1 Charles Atkinson
	dateext
195 1 Charles Atkinson
	dateyesterday
196 1 Charles Atkinson
	missingok
197 1 Charles Atkinson
	notifempty
198 1 Charles Atkinson
	compress
199 1 Charles Atkinson
	delaycompress
200 1 Charles Atkinson
	sharedscripts
201 1 Charles Atkinson
	postrotate
202 1 Charles Atkinson
		invoke-rc.d rsyslog rotate > /dev/null
203 1 Charles Atkinson
	endscript
204 1 Charles Atkinson
}
205 1 Charles Atkinson
206 1 Charles Atkinson
</pre>
207 1 Charles Atkinson
208 1 Charles Atkinson
h2. MikroTik routers
209 1 Charles Atkinson
210 1 Charles Atkinson
<pre>
211 1 Charles Atkinson
/system logging action
212 1 Charles Atkinson
set 3 bsd-syslog=yes remote=<syslog server address> src-address=<router address to send messages from> \
213 1 Charles Atkinson
    syslog-facility=local0 syslog-severity=alert
214 1 Charles Atkinson
</pre>