Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| technical:remote_syslog_setup [2025/06/11 04:23] – updating syslog configs and other stuff super_stunder | technical:remote_syslog_setup [2025/06/11 04:45] (current) – [Going against the Linux Gods] super_stunder | ||
|---|---|---|---|
| Line 90: | Line 90: | ||
| Here is a my / | Here is a my / | ||
| - | + | <codeprism | |
| - | <fileprism | + | |
| # / | # / | ||
| # | # | ||
| Line 146: | Line 145: | ||
| :msg, contains, " | :msg, contains, " | ||
| - | # This will forward all of the Firewall Logs to the syslog01 server over UDP 514 | + | # This will forward all of the Firewall Logs to the syslog01 server |
| :msg, contains, " | :msg, contains, " | ||
| Line 152: | Line 151: | ||
| :msg, contains, " | :msg, contains, " | ||
| - | # Send all other messages to the journald socket | + | # Send all other messages to the journald socket |
| *.* action(type=" | *.* action(type=" | ||
| Line 173: | Line 172: | ||
| # | # | ||
| *.emerg : | *.emerg : | ||
| - | </fileprism> | + | </codeprism> |
| Line 182: | Line 181: | ||
| </ | </ | ||
| - | < | + | < |
| # Use ' | # Use ' | ||
| # | # | ||
| Line 220: | Line 219: | ||
| </ | </ | ||
| - | Here's my /etc/rsyslog.conf on the logger servers. | + | Once you have rsyslog configured and logging disabled going to journald you need to restart both logging services. |
| + | |||
| + | < | ||
| + | systemctl restart systemd-journald.service | ||
| + | systemctl restart rsyslog.service | ||
| + | </ | ||
| + | |||
| Alright I have the basics running now but need to address a couple of things. | Alright I have the basics running now but need to address a couple of things. | ||
| + | |||
| + | === The Syslog Server - syslog01 === | ||
| + | FIXME | ||
| + | |||
| + | Now you should see both servers " | ||
| + | < | ||
| + | 2025-06-11T04: | ||
| + | 2025-06-11T04: | ||
| + | </ | ||
| - < | - < | ||
| - Even though I have loaded RSYSLOG all logs are still going to the systemd logs. I want to keep the system logs pointed to systemd (let it do its thing) and have all of the firewalls logs sent to /var/log for text based processing. :!: I thought this was going to be an option, turns out log flexibility has gone away now that the world of Linux has push to systemd | - Even though I have loaded RSYSLOG all logs are still going to the systemd logs. I want to keep the system logs pointed to systemd (let it do its thing) and have all of the firewalls logs sent to /var/log for text based processing. :!: I thought this was going to be an option, turns out log flexibility has gone away now that the world of Linux has push to systemd | ||
| - | |||
| FIXME | FIXME | ||
| Line 238: | Line 252: | ||
| By implementing this iptables policy, a firewall that allows SSH on port 22, denies all other inbound traffic, and logs both accepted and denied packets with the desired prefix can be created. | By implementing this iptables policy, a firewall that allows SSH on port 22, denies all other inbound traffic, and logs both accepted and denied packets with the desired prefix can be created. | ||
| - | + | [[: | |