logging_custom_templates: A list of custom template
+definitions, for use with logging_outputs type
+files and type forwards. You can
+specify the template for a particular output to use by setting the
+template field in a particular logging_outputs
+specification, or by setting the default for all such outputs to use in
+logging_files_template_format and
+logging_forwards_template_format.
Specify custom templates like this, in either the legacy format or +the new style format:
+logging_custom_templates:
+ - |
+ template(name="tpl1" type="list") {
+ constant(value="Syslog MSG is: '")
+ property(name="msg")
+ constant(value="', ")
+ property(name="timereported" dateFormat="rfc3339" caseConversion="lower")
+ constant(value="\n")
+ }
+ - >-
+ $template precise,"%syslogpriority%,%syslogfacility%,%timegenerated::fulltime%,%HOSTNAME%,%syslogtag%,%msg%\n"Then use like this:
+logging_outputs:
+ - name: custom_file_output
+ type: files
+ path: /var/log/custom_file_output.log
+ template: tpl1 # override logging_files_template_format if setlogging_outputs: A list of following dictionary to
configure outputs.
logging_outputs:
- - name: files_output
- type: files
- queue:
- size: 100logging_outputs:
+ - name: files_output
+ type: files
+ queue:
+ size: 100logging_outputs:
- - name: forwards_output
- type: forwards
- target: your_target_host
- action:
- writeallmarkmessages: "on"logging_outputs:
+ - name: forwards_output
+ type: forwards
+ target: your_target_host
+ action:
+ writeallmarkmessages: "on"elasticsearch output supports sending logs to
@@ -684,10 +716,6 @@
property_value: Value in property-based filter; default
to errorpath: Path to the output file.logging_files_template_format: Set default template for
-the files output. Allowed values are traditional,
-syslog, and modern. Default to
-modern.file module:
dirGroupNum, otherwise, set
dirGroup.template: Template format for the particular files
+output. Allowed values are traditional,
+syslog, and modern, or one of the templates
+defined in logging_custom_templates. Default to
+modern.Global options:
+logging_files_template_format: Set default template for
+the files output. Allowed values are traditional,
+syslog, and modern, or one of the templates
+defined in logging_custom_templates. Default to
+modern.
Note: Selector options and property-based filter options are exclusive. If Property-based filter options are defined, selector options will be ignored.
Note: Unless the above options are given, these local file outputs are configured.
- kern.* /dev/console
- *.info;mail.none;authpriv.none;cron.none /var/log/messages
- authpriv.* /var/log/secure
- mail.* -/var/log/maillog
- cron.* -/var/log/cron
- *.emerg :omusrmsg:*
- uucp,news.crit /var/log/spooler
- local7.* kern.* /dev/console
+ *.info;mail.none;authpriv.none;cron.none /var/log/messages
+ authpriv.* /var/log/secure
+ mail.* -/var/log/maillog
+ cron.* -/var/log/cron
+ *.emerg :omusrmsg:*
+ uucp,news.crit /var/log/spooler
+ local7.*forwards output sends logs to the remote logging system
@@ -765,12 +804,15 @@
*.{{ logging_domain }}
template: Template format for the particular forwards
output. Allowed values are traditional,
-syslog, and modern. Default to
+syslog, and modern, or one of the templates
+defined in logging_custom_templates. Default to
modern.logging_forwards_template_format: Set default template for the
-forwards output. Allowed values are traditional,
-syslog, and modern. Default to
+
Global options:
+logging_forwards_template_format: Set default template
+for the forwards output. Allowed values are traditional,
+syslog, and modern, or one of the templates
+defined in logging_custom_templates. Default to
modern.
Note: Selector options and property-based filter options are exclusive. If Property-based filter options are defined, @@ -851,33 +893,33 @@
Note: If both remote_log_path and
remote_sub_path are not specified, the remote_file
output configured with the following settings.
template(
- name="RemoteMessage"
- type="string"
- string="/var/log/remote/msg/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
- )
- template(
- name="RemoteHostAuthLog"
- type="string"
- string="/var/log/remote/auth/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
- )
- template(
- name="RemoteHostCronLog"
- type="string"
- string="/var/log/remote/cron/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
- )
- template(
- name="RemoteHostMailLog"
- type="string"
- string="/var/log/remote/mail/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
- )
- ruleset(name="unique_remote_files_output_name") {
- authpriv.* action(name="remote_authpriv_host_log" type="omfile" DynaFile="RemoteHostAuthLog")
- *.info;mail.none;authpriv.none;cron.none action(name="remote_message" type="omfile" DynaFile="RemoteMessage")
- cron.* action(name="remote_cron_log" type="omfile" DynaFile="RemoteHostCronLog")
- mail.* action(name="remote_mail_service_log" type="omfile" DynaFile="RemoteHostMailLog")
- } template(
+ name="RemoteMessage"
+ type="string"
+ string="/var/log/remote/msg/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
+ )
+ template(
+ name="RemoteHostAuthLog"
+ type="string"
+ string="/var/log/remote/auth/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
+ )
+ template(
+ name="RemoteHostCronLog"
+ type="string"
+ string="/var/log/remote/cron/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
+ )
+ template(
+ name="RemoteHostMailLog"
+ type="string"
+ string="/var/log/remote/mail/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
+ )
+ ruleset(name="unique_remote_files_output_name") {
+ authpriv.* action(name="remote_authpriv_host_log" type="omfile" DynaFile="RemoteHostAuthLog")
+ *.info;mail.none;authpriv.none;cron.none action(name="remote_message" type="omfile" DynaFile="RemoteMessage")
+ cron.* action(name="remote_cron_log" type="omfile" DynaFile="RemoteHostCronLog")
+ mail.* action(name="remote_mail_service_log" type="omfile" DynaFile="RemoteHostMailLog")
+ }name: Unique name of the flow.logging_cert.crt is in /etc/pki/tls/certs
signed by the CA certificate managed by ipa.
logging_certificates:
- - name: logging_cert
- dns: ['localhost', 'www.example.com']
- ca: ipa logging_certificates:
+ - name: logging_cert
+ dns: ['localhost', 'www.example.com']
+ ca: ipaThe created private key and certificate are set with the ca
certificate, e.g., in logging_pki_files as follows:
logging_pki_files:
- - ca_cert: /etc/ipa/ca.crt
- cert: /etc/pki/tls/certs/logging_cert.crt
- private_key: /etc/pki/tls/private/logging_cert.key logging_pki_files:
+ - ca_cert: /etc/ipa/ca.crt
+ cert: /etc/pki/tls/certs/logging_cert.crt
+ private_key: /etc/pki/tls/private/logging_cert.keyor in the relp parameters as follows:
logging_inputs:
- - name: relp_server
- type: relp
- tls: true
- ca_cert: /etc/ipa/ca.crt
- cert: /etc/pki/tls/certs/logging_cert.crt
- private_key: /etc/pki/tls/private/logging_cert.key
- [snip] logging_inputs:
+ - name: relp_server
+ type: relp
+ tls: true
+ ca_cert: /etc/ipa/ca.crt
+ cert: /etc/pki/tls/certs/logging_cert.crt
+ private_key: /etc/pki/tls/private/logging_cert.key
+ [snip]NOTE: The certificate role, unless using IPA and joining
the systems to an IPA domain, creates self-signed certificates, so you
will need to explicitly configure trust, which is not currently
@@ -1053,23 +1095,23 @@
logging_inputs:
- - name: input_nameA
- type: input_typeA
- state: absent
- - name: input_nameB
- type: input_typeB
-logging_outputs:
- - name: output_name0
- type: output_type0
- state: absent
- - name: output_name1
- type: output_type1
-logging_flows:
- - name: flow_nameY
- inputs: [input_nameB]
- outputs: [output_name1]logging_inputs:
+ - name: input_nameA
+ type: input_typeA
+ state: absent
+ - name: input_nameB
+ type: input_typeB
+logging_outputs:
+ - name: output_name0
+ type: output_type0
+ state: absent
+ - name: output_name1
+ type: output_type1
+logging_flows:
+ - name: flow_nameY
+ inputs: [input_nameB]
+ outputs: [output_name1]If you want to remove all the configuration files previously
configured, in addition to setting state: absent to each
logging_inputs and logging_outputs item, add
@@ -1077,296 +1119,238 @@
logging_purge_confs: true to wipe out all
previous configuration and replace it with your given configuration.
-logging_enabled: false
-logging_inputs:
- - name: input_nameA
- type: input_typeA
- state: absent
- - name: input_nameB
- type: input_typeB
- state: absent
-logging_outputs:
- - name: output_name0
- type: output_type0
- state: absent
- - name: output_name1
- type: output_type1
- state: absent
-logging_flows:
- - name: flow_nameY
- inputs: [input_nameB]
- outputs: [output_name1]logging_enabled: false
+logging_inputs:
+ - name: input_nameA
+ type: input_typeA
+ state: absent
+ - name: input_nameB
+ type: input_typeB
+ state: absent
+logging_outputs:
+ - name: output_name0
+ type: output_type0
+ state: absent
+ - name: output_name1
+ type: output_type1
+ state: absent
+logging_flows:
+ - name: flow_nameY
+ inputs: [input_nameB]
+ outputs: [output_name1]Deploying basics input reading logs from systemd journal
and implicit files output to write to the local files. This
also deploys two custom files to the /etc/rsyslog.d/
directory.
---
-- name: Deploying basics input and implicit files output
- hosts: all
- roles:
- - linux-system-roles.logging
- vars:
- logging_custom_config_files:
- - files/90-my-custom-file.conf
- - files/my-custom-file.rulebase
- logging_inputs:
- - name: system_input
- type: basicsThe following playbook generates the same logging configuration -files.
----
-- name: Deploying basics input and files output
- hosts: all
- roles:
- - linux-system-roles.logging
- vars:
- logging_custom_config_files:
- - files/90-my-custom-file.conf
- - files/my-custom-file.rulebase
- logging_inputs:
- - name: system_input
- type: basics
- logging_outputs:
- - name: files_output
- type: files
- logging_flows:
- - name: flow0
- inputs: [system_input]
- outputs: [files_output]Deploying basics input reading logs from systemd unix
-socket and files output to write to the local files.
---
-- name: Deploying basics input using systemd unix socket and files output
+- name: Deploying basics input and implicit files output
hosts: all
roles:
- linux-system-roles.logging
vars:
- logging_inputs:
- - name: system_input
- type: basics
- use_imuxsock: true
- logging_outputs:
- - name: files_output
- type: files
- logging_flows:
- - name: flow0
- inputs: [system_input]
- outputs: [files_output]Deploying basics input reading logs from systemd journal
-and files output to write to the individually configured
-local files. This also shows how to specify ownership/permission for log
-files/directories created by the logger.
The following playbook generates the same logging configuration +files.
---
-- name: Deploying basic input and configured files output
+- name: Deploying basics input and files output
hosts: all
roles:
- linux-system-roles.logging
vars:
- logging_inputs:
- - name: system_input
- type: basics
- logging_outputs:
- - name: files_output0
- type: files
- severity: info
- exclude:
- - authpriv.none
- - auth.none
- - cron.none
- - mail.none
- path: /var/log/messages
- - name: files_output1
- type: files
- facility: authpriv,auth
- path: /var/log/secure
- - name: files_output2
- type: files
- severity: info
- path: /var/log/myapp/my_app.log
- mode: "0600"
- owner: logowner
- group: loggroup
- dir_mode: "0700"
- dir_owner: logowner
- dir_group: loggroup
- logging_flows:
- - name: flow0
- inputs: [system_input]
- outputs: [files_output0, files_output1]Deploying files input reading logs from local files and
-files output to write to the individually configured local
-files.
Deploying basics input reading logs from systemd unix
+socket and files output to write to the local files.
---
-- name: Deploying files input and configured files output
+- name: Deploying basics input using systemd unix socket and files output
hosts: all
roles:
- linux-system-roles.logging
vars:
logging_inputs:
- - name: files_input0
- type: files
- input_log_path: /var/log/containerA/*.log
- - name: files_input1
- type: files
- input_log_path: /var/log/containerB/*.log
- logging_outputs:
- - name: files_output0
- type: files
- severity: info
- exclude:
- - authpriv.none
- - auth.none
- - cron.none
- - mail.none
- path: /var/log/messages
- - name: files_output1
- type: files
- facility: authpriv,auth
- path: /var/log/secure
- logging_flows:
- - name: flow0
- inputs: [files_input0, files_input1]
- outputs: [files_output0, files_output1]Deploying files input reading logs from local files and
-files output to write to the local files based on the
-property-based filters.
Deploying basics input reading logs from systemd journal
+and files output to write to the individually configured
+local files. This also shows how to specify ownership/permission for log
+files/directories created by the logger.
---
-- name: Deploying files input and configured files output
+- name: Deploying basic input and configured files output
hosts: all
roles:
- linux-system-roles.logging
vars:
logging_inputs:
- - name: files_input0
- type: files
- input_log_path: /var/log/containerA/*.log
- - name: files_input1
+ - name: system_input
+ type: basics
+ logging_outputs:
+ - name: files_output0
type: files
- input_log_path: /var/log/containerB/*.log
- logging_outputs:
- - name: files_output0
- type: files
- property: msg
- property_op: contains
- property_value: error
- path: /var/log/errors.log
- - name: files_output1
- type: files
- property: msg
- property_op: "!contains"
- property_value: error
- path: /var/log/others.log
- logging_flows:
- - name: flow0
- inputs: [files_input0, files_input1]
- outputs: [files_output0, files_output1]Deploying basics input reading logs from systemd journal
-and forwards output to forward the logs to the remote
-rsyslog.
Deploying files input reading logs from local files and
+files output to write to the individually configured local
+files.
---
-- name: Deploying basics input and forwards output
- hosts: clients
+- name: Deploying files input and configured files output
+ hosts: all
roles:
- linux-system-roles.logging
vars:
logging_inputs:
- - name: basic_input
- type: basics
- logging_outputs:
- - name: forward_output0
- type: forwards
- severity: info
- target: your_target_hostname
- udp_port: 514
- - name: forward_output1
- type: forwards
- facility: mail
- target: your_target_hostname
- tcp_port: 514
- logging_flows:
- - name: flows0
- inputs: [basic_input]
- outputs: [forward_output0, forward_output1]Deploying files input reading logs from a local file and
-forwards output to forward the logs to the remote rsyslog
-over tls. Assuming the ca_cert, cert and key files are prepared at the
-specified paths on the control host. The files are deployed to the
-default location /etc/pki/tls/certs/,
-/etc/pki/tls/certs/, and /etc/pki/tls/private,
-respectively.
Deploying files input reading logs from local files and
+files output to write to the local files based on the
+property-based filters.
---
-- name: Deploying files input and forwards output with certs
- hosts: clients
+- name: Deploying files input and configured files output
+ hosts: all
roles:
- linux-system-roles.logging
vars:
- logging_pki_files:
- - ca_cert_src: /local/path/to/ca_cert
- cert_src: /local/path/to/cert
- private_key_src: /local/path/to/key
- logging_inputs:
- - name: files_input
- type: files
- input_log_path: /var/log/containers/*.log
- logging_outputs:
- - name: forwards_output
- type: forwards
- target: your_target_host
- tcp_port: your_target_port
- pki_authmode: x509/name
- permitted_server: '*.example.com'
- logging_flows:
- - name: flows0
- inputs: [basic_input]
- outputs: [forwards-severity_and_facility]Deploying remote input reading logs from remote rsyslog
-and remote_files output to write the logs to the local
-files under the directory named by the remote host name.
Deploying basics input reading logs from systemd journal
+and forwards output to forward the logs to the remote
+rsyslog.
---
-- name: Deploying remote input and remote_files output
- hosts: server
+- name: Deploying basics input and forwards output
+ hosts: clients
roles:
- linux-system-roles.logging
vars:
logging_inputs:
- - name: remote_udp_input
- type: remote
- udp_ports: [514, 1514]
- - name: remote_tcp_input
- type: remote
- tcp_ports: [514, 1514]
- logging_outputs:
- - name: remote_files_output
- type: remote_files
- logging_flows:
- - name: flow_0
- inputs: [remote_udp_input, remote_tcp_input]
- outputs: [remote_files_output]Deploying remote input reading logs from remote rsyslog
-and remote_files output to write the logs to the configured
-local files with the tls setup supporting 20 clients. Assuming the
-ca_cert, cert and key files are prepared at the specified paths on the
-control host. The files are deployed to the default location
-/etc/pki/tls/certs/, /etc/pki/tls/certs/, and
-/etc/pki/tls/private, respectively.
Deploying files input reading logs from a local file and
+forwards output to forward the logs to the remote rsyslog
+over tls. Assuming the ca_cert, cert and key files are prepared at the
+specified paths on the control host. The files are deployed to the
+default location /etc/pki/tls/certs/,
+/etc/pki/tls/certs/, and /etc/pki/tls/private,
+respectively.
---
-- name: Deploying remote input and remote_files output with certs
- hosts: server
+- name: Deploying files input and forwards output with certs
+ hosts: clients
roles:
- linux-system-roles.logging
vars:
@@ -1375,86 +1359,144 @@ Server configuration
cert_src: /local/path/to/cert
private_key_src: /local/path/to/key
logging_inputs:
- - name: remote_tcp_input
- type: remote
- tcp_ports: [6514, 7514]
- permitted_clients: ['*.example.com', '*.test.com']
- logging_outputs:
- - name: remote_files_output0
- type: remote_files
- remote_log_path: /var/log/remote/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log
- async_writing: true
- client_count: 20
- io_buffer_size: 8192
- - name: remote_files_output1
- type: remote_files
- remote_sub_path: others/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log
- logging_flows:
- - name: flow_0
- inputs: [remote_udp_input, remote_tcp_input]
- outputs: [remote_files_output0, remote_files_output1]Deploying basics input reading logs from systemd journal
-and relp output to send the logs to the remote rsyslog over
-relp.
Deploying remote input reading logs from remote rsyslog
+and remote_files output to write the logs to the local
+files under the directory named by the remote host name.
---
-- name: Deploying basics input and relp output
- hosts: clients
+- name: Deploying remote input and remote_files output
+ hosts: server
roles:
- linux-system-roles.logging
vars:
logging_inputs:
- - name: basic_input
- type: basics
- logging_outputs:
- - name: relp_client
- type: relp
- target: logging.server.com
- port: 20514
- tls: true
- ca_cert_src: /path/to/ca.pem
- cert_src: /path/to/client-cert.pem
- private_key_src: /path/to/client-key.pem
- pki_authmode: name
- permitted_servers:
- - '*.server.com'
- logging_flows:
- - name: flow
- inputs: [basic_input]
- outputs: [relp_client]Deploying relp input reading logs from remote rsyslog
-and remote_files output to write the logs to the local
-files under the directory named by the remote host name.
Deploying remote input reading logs from remote rsyslog
+and remote_files output to write the logs to the configured
+local files with the tls setup supporting 20 clients. Assuming the
+ca_cert, cert and key files are prepared at the specified paths on the
+control host. The files are deployed to the default location
+/etc/pki/tls/certs/, /etc/pki/tls/certs/, and
+/etc/pki/tls/private, respectively.
---
-- name: Deploying remote input and remote_files output
+- name: Deploying remote input and remote_files output with certs
hosts: server
roles:
- linux-system-roles.logging
vars:
- logging_inputs:
- - name: relp_server
- type: relp
- port: 20514
- tls: true
- ca_cert_src: /path/to/ca.pem
- cert_src: /path/to/server-cert.pem
- private_key_src: /path/to/server-key.pem
- pki_authmode: name
- permitted_clients:
- - '*.client.com'
- - '*.example.com'
- logging_outputs:
- - name: remote_files_output
- type: remote_files
- logging_flows:
- - name: flow
- inputs: [relp_server]
- outputs: [remote_files_output]Deploying basics input reading logs from systemd journal
+and relp output to send the logs to the remote rsyslog over
+relp.
---
+- name: Deploying basics input and relp output
+ hosts: clients
+ roles:
+ - linux-system-roles.logging
+ vars:
+ logging_inputs:
+ - name: basic_input
+ type: basics
+ logging_outputs:
+ - name: relp_client
+ type: relp
+ target: logging.server.com
+ port: 20514
+ tls: true
+ ca_cert_src: /path/to/ca.pem
+ cert_src: /path/to/client-cert.pem
+ private_key_src: /path/to/client-key.pem
+ pki_authmode: name
+ permitted_servers:
+ - '*.server.com'
+ logging_flows:
+ - name: flow
+ inputs: [basic_input]
+ outputs: [relp_client]Deploying relp input reading logs from remote rsyslog
+and remote_files output to write the logs to the local
+files under the directory named by the remote host name.
---
+- name: Deploying remote input and remote_files output
+ hosts: server
+ roles:
+ - linux-system-roles.logging
+ vars:
+ logging_inputs:
+ - name: relp_server
+ type: relp
+ port: 20514
+ tls: true
+ ca_cert_src: /path/to/ca.pem
+ cert_src: /path/to/server-cert.pem
+ private_key_src: /path/to/server-key.pem
+ pki_authmode: name
+ permitted_clients:
+ - '*.client.com'
+ - '*.example.com'
+ logging_outputs:
+ - name: remote_files_output
+ type: remote_files
+ logging_flows:
+ - name: flow
+ inputs: [relp_server]
+ outputs: [remote_files_output]When a port is specified in the logging role configuration, the @@ -1465,17 +1507,17 @@
You can verify the changes by the following command-line.
For firewall,
-firewall-cmd --list-portfirewall-cmd --list-portFor SELinux,
-semanage port --list | grep "syslog"semanage port --list | grep "syslog"The newly specified port will be added to this default set.
-syslog_tls_port_t tcp 6514, 10514
-syslog_tls_port_t udp 6514, 10514
-syslogd_port_t tcp 601, 20514
-syslogd_port_t udp 514, 601, 20514syslog_tls_port_t tcp 6514, 10514
+syslog_tls_port_t udp 6514, 10514
+syslogd_port_t tcp 601, 20514
+syslogd_port_t udp 514, 601, 20514