Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| technical:remote_syslog_setup [2025/06/06 02:41] – super_stunder | technical:remote_syslog_setup [2025/06/11 04:45] (current) – [Going against the Linux Gods] super_stunder | ||
|---|---|---|---|
| Line 76: | Line 76: | ||
| </ | </ | ||
| + | |||
| + | ===== The drama of logging in Linux ===== | ||
| + | I didn't know in this journey to consolidate logs to a centralized server I was going to end up blogging so much. Turns out I needed to start another post to talk about the usage of systemd' | ||
| + | |||
| + | ==== Going against the Linux Gods ==== | ||
| + | Now we need to shut off kernel logging in the journald. I go into details about this in the blog posting mentioned above, but I don't like the idea of cutting off kernel logs going to journald. | ||
| + | |||
| + | === Install rsyslog and disable kernal logging in journald === | ||
| + | Basic rsyslog install is fine | ||
| + | <cli> | ||
| + | apt install rsyslog | ||
| + | </ | ||
| + | |||
| + | Here is a my / | ||
| + | < | ||
| + | # / | ||
| + | # | ||
| + | # For more information install rsyslog-doc and see | ||
| + | # / | ||
| + | |||
| + | |||
| + | ################# | ||
| + | #### MODULES #### | ||
| + | ################# | ||
| + | |||
| + | module(load=" | ||
| + | module(load=" | ||
| + | # | ||
| + | |||
| + | # provides UDP syslog reception | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # provides TCP syslog reception | ||
| + | # | ||
| + | # | ||
| + | |||
| + | |||
| + | ########################### | ||
| + | #### GLOBAL DIRECTIVES #### | ||
| + | ########################### | ||
| + | |||
| + | # | ||
| + | # Set the default permissions for all log files. | ||
| + | # | ||
| + | $FileOwner root | ||
| + | $FileGroup adm | ||
| + | $FileCreateMode 0640 | ||
| + | $DirCreateMode 0755 | ||
| + | $Umask 0022 | ||
| + | |||
| + | # | ||
| + | # Where to place spool and state files | ||
| + | # | ||
| + | $WorkDirectory / | ||
| + | |||
| + | # | ||
| + | # Include all config files in / | ||
| + | # | ||
| + | $IncludeConfig / | ||
| + | |||
| + | |||
| + | ############### | ||
| + | #### RULES #### | ||
| + | ############### | ||
| + | |||
| + | # Forward messages with " | ||
| + | :msg, contains, " | ||
| + | |||
| + | # This will forward all of the Firewall Logs to the syslog01 server from /etc/hosts over UDP 514 | ||
| + | :msg, contains, " | ||
| + | |||
| + | # Discard messages with the " | ||
| + | :msg, contains, " | ||
| + | |||
| + | # Send all other messages to the journald socket - not sure this is needed I am doing it all in syslog now might remove later. | ||
| + | *.* action(type=" | ||
| + | |||
| + | # | ||
| + | # Log anything besides private authentication messages to a single log file | ||
| + | # | ||
| + | *.*; | ||
| + | |||
| + | # | ||
| + | # Log commonly used facilities to their own log file | ||
| + | # | ||
| + | auth, | ||
| + | cron.* -/ | ||
| + | kern.* -/ | ||
| + | mail.* -/ | ||
| + | user.* -/ | ||
| + | |||
| + | # | ||
| + | # Emergencies are sent to everybody logged in. | ||
| + | # | ||
| + | *.emerg : | ||
| + | </ | ||
| + | |||
| + | |||
| + | Then edit / | ||
| + | |||
| + | <cli> | ||
| + | root@logger02: | ||
| + | </ | ||
| + | |||
| + | <code title=journald.conf el=true hl=34> | ||
| + | # Use ' | ||
| + | # | ||
| + | # See journald.conf(5) for details. | ||
| + | |||
| + | [Journal] | ||
| + | # | ||
| + | # | ||
| + | #Seal=yes | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | ForwardToSyslog=yes | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | MaxLevelSyslog=warn | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | ReadKMsg=no | ||
| + | #Audit=no | ||
| + | </ | ||
| + | |||
| + | Once you have rsyslog configured and logging disabled going to journald you need to restart both logging services. | ||
| + | |||
| + | <cli> | ||
| + | systemctl restart systemd-journald.service | ||
| + | systemctl restart rsyslog.service | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| Alright I have the basics running now but need to address a couple of things. | Alright I have the basics running now but need to address a couple of things. | ||
| + | |||
| + | === The Syslog Server - syslog01 === | ||
| + | FIXME | ||
| + | |||
| + | Now you should see both servers " | ||
| + | < | ||
| + | 2025-06-11T04: | ||
| + | 2025-06-11T04: | ||
| + | </ | ||
| - < | - < | ||
| - Even though I have loaded RSYSLOG all logs are still going to the systemd logs. I want to keep the system logs pointed to systemd (let it do its thing) and have all of the firewalls logs sent to /var/log for text based processing. :!: I thought this was going to be an option, turns out log flexibility has gone away now that the world of Linux has push to systemd | - Even though I have loaded RSYSLOG all logs are still going to the systemd logs. I want to keep the system logs pointed to systemd (let it do its thing) and have all of the firewalls logs sent to /var/log for text based processing. :!: I thought this was going to be an option, turns out log flexibility has gone away now that the world of Linux has push to systemd | ||
| - | |||
| FIXME | FIXME | ||
| Line 92: | Line 252: | ||
| By implementing this iptables policy, a firewall that allows SSH on port 22, denies all other inbound traffic, and logs both accepted and denied packets with the desired prefix can be created. | By implementing this iptables policy, a firewall that allows SSH on port 22, denies all other inbound traffic, and logs both accepted and denied packets with the desired prefix can be created. | ||
| - | + | [[: | |