MonitorWare Knowledge Base

I'm new to rsyslog but after several hours of searching yesterday, I can't find a solution I like.

Below I have printed the default .conf file. I kind of like and am accustomed to the way that it records logs. I have scripts and whatnot that look at them and I'd rather leave this format as is. However, the system is now going to be a centralized server. I added another .conf file that I can hide/show the file to toggle the function. I can also copy the file for every other system I want sending it logs.

That said, I want local logs where they are, then remote system's logs in another place. As it is currently configured, it sends the remote logs to both locations. What is the cleanest way to block logging of anything but local logs according to the main config file? Also, less important at this time, what can I add to the secondary .conf file to only allow UDP connections from certain IPs? Preferably right under the "$UDPServerRun..." line in each secondary .conf file.

firewall.conf:

Code: Select all

$ModLoad imudp
$UDPServerRun 514

$template FW,"/usr/log/%HOSTNAME%.%$DAY%"
if $hostname contains 'firewall_hostname_here' then ?FW

rsyslog.conf

Code: Select all

#  /etc/rsyslog.conf    Configuration file for rsyslog v3.
#
#                       For more information see
#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use default timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

#
# Logging for INN news system.
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                         *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#       news.=crit;news.=err;news.=notice;\
#       *.=debug;*.=info;\
#       *.=notice;*.=warn       /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole


• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

I re-re-read this post:
http://kb.monitorware.com/stop-remote-firewall-logs-from-writing-to-messages-t8863.html

I noticed this line:

The second line the removes those messages from being processed further.

(Emphasis added)

Referring to:

Code: Select all

:fromhost,contains,"slb" ~

I changed the hostname and it seems to do what I want, though I have to explicitly add this for every machine that might send logs in the future.

SO, I killed the secondary file as the several ways I tried configuring it, everything always failed (sometimes badly). I'd still like that function but commenting/uncommenting will work for now.

I'm doing the same thing - /var/log/ files are from the local system only, and all logs are then sent to /logs/<hostname>/ using the same file structure as a normal system (messages, maillog, etc). What you want is more like this : http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory.

The only thing I can add is that 'localhost' doesn't work for me, I have to use the actual hostname of the localhost instead. OS configuration thingy, I'm sure, but it works just fine.

hase wrote:Below I have printed the default .conf file. I kind of like and am accustomed to the way that it records logs. I have scripts and whatnot that look at them and I'd rather leave this format as is. However, the system is now going to be a centralized server. I added another .conf file that I can hide/show the file to toggle the function. I can also copy the file for every other system I want sending it logs.

I don't quite follow what you're accomplishing through this, but I think you're trying to find a quick and easy way to change whether log messages from a given host is accepted or rejected at the server end of things. If this is correct, I have one big question: why? Does your environment really change frequently enough to justify this complexity? If you want a central syslog server that simply maintains separation between remote and local logs, something like this will be much easier on you (and require no modification no matter how many servers you add):

Code: Select all

# ----------------------------------------
# Input/output modules
# ----------------------------------------
$ModLoad immark.so   # --MARK-- message capability
$ModLoad imuxsock.so   # support for local system logging
$ModLoad imklog.so   # kernel logging support
$ModLoad imudp.so   # UDP syslog input

# ----------------------------------------
# Global Settings
# ----------------------------------------
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$MarkMessagePeriod 1800
$UDPServerAddress <[i]my-IP[/i]>
$UDPServerRun 514

# ----------------------------------------
# Templates
# ----------------------------------------
$template remote_log, "/usr/log/%HOSTNAME%.%$DAY%"

# ----------------------------------------
# Local logs
# ----------------------------------------
+mylocalhostname

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log

<[i]all the rest of your local log statements here[/i]>

# ----------------------------------------
# Remote logs
# ----------------------------------------
-mylocalhostname

*.*                          ?remote_log


It's also worth noting that in your scheme below, you're opening a UDP port in your other included configs. I'd strongly recommend against that - it can only lead to trouble later on. Open your multiple-use input channels in the main file, your single-use (like a special imfile for some weird host, or whatever) inputs in their configs.

hase wrote:That said, I want local logs where they are, then remote system's logs in another place. As it is currently configured, it sends the remote logs to both locations. What is the cleanest way to block logging of anything but local logs according to the main config file?

Use the +/- BSD syslog.conf syntax. +/-localhost does not work, so use your server's real hostname. If you wanted to integrate this into your current configs, move your includeconfig statement down toward the bottom. Your end product would look something like this:

Code: Select all

###############
#### RULES ####
###############
+yourlocalhostname

#
# First some standard log files.  Log by facility.
#
...

...

-yourlocalhostname
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


hase wrote:Also, less important at this time, what can I add to the secondary .conf file to only allow UDP connections from certain IPs? Preferably right under the "$UDPServerRun..." line in each secondary .conf file.

Use the $AllowedSender directive - http://www.rsyslog.com/doc-rsconf1_allowedsender.html

-HKS