From 43373a2efaae2a7b109b37d8bdc04f78ffa2d73d Mon Sep 17 00:00:00 2001 From: Rich Megginson Date: Tue, 12 Nov 2024 13:49:30 -0700 Subject: [PATCH] docs(changelog): version 1.14.0 [citest skip] Update changelog and .README.html for version 1.14.0 Signed-off-by: Rich Megginson --- .README.html | 858 +++++++++++++++++++++++++++------------------------ CHANGELOG.md | 7 + 2 files changed, 457 insertions(+), 408 deletions(-) diff --git a/.README.html b/.README.html index f2bbd087..5a516c9a 100644 --- a/.README.html +++ b/.README.html @@ -163,6 +163,8 @@

Contents

  • logging_inputs remote type
    • +
  • logging_custom_templates
  • Logging_outputs options
      @@ -557,6 +559,36 @@

      logging_inputs remote type

      - name: remote_tcp type: remote tcp_ports: [1514] +

      logging_custom_templates

      +

      logging_custom_templates: A list of custom template +definitions, for use with logging_outputs type +files and type forwards. You can +specify the template for a particular output to use by setting the +template field in a particular logging_outputs +specification, or by setting the default for all such outputs to use in +logging_files_template_format and +logging_forwards_template_format.

      +

      Specify custom templates like this, in either the legacy format or +the new style format:

      +
      logging_custom_templates:
+  - |
+    template(name="tpl1" type="list") {
+        constant(value="Syslog MSG is: '")
+        property(name="msg")
+        constant(value="', ")
+        property(name="timereported" dateFormat="rfc3339" caseConversion="lower")
+        constant(value="\n")
+        }
+  - >-
+    $template precise,"%syslogpriority%,%syslogfacility%,%timegenerated::fulltime%,%HOSTNAME%,%syslogtag%,%msg%\n"
      +

      Then use like this:

      +
      logging_outputs:
+  - name: custom_file_output
+    type: files
+    path: /var/log/custom_file_output.log
+    template: tpl1  # override logging_files_template_format if set

      Logging_outputs options

      logging_outputs: A list of following dictionary to configure outputs.

      @@ -581,12 +613,12 @@

      logging_outputs can be used by all output module types, see the official rsyslog documentation for full list of parameters and their function.

    -
    logging_outputs:
-  - name: files_output
-    type: files
-    queue:
-      size: 100
    +
    logging_outputs:
+  - name: files_output
+    type: files
+    queue:
+      size: 100

    logging_outputs general action parameters

      @@ -594,13 +626,13 @@

      logging_outputs the official rsyslog documentation for full list of parameters and their function.

    -
    logging_outputs:
-  - name: forwards_output
-    type: forwards
-    target: your_target_host
-    action:
-      writeallmarkmessages: "on"
    +
    logging_outputs:
+  - name: forwards_output
+    type: forwards
+    target: your_target_host
+    action:
+      writeallmarkmessages: "on"

    logging_outputs elasticsearch type

    elasticsearch output supports sending logs to @@ -684,10 +716,6 @@

    logging_outputs files type

  • property_value: Value in property-based filter; default to error
  • path: Path to the output file.
    • -
  • logging_files_template_format: Set default template for -the files output. Allowed values are traditional, -syslog, and modern. Default to -modern.
  • File/Directory properties - same as corresponding variables of the Ansible file module:
      @@ -712,21 +740,32 @@

      logging_outputs files type

      value is an integer, set dirGroupNum, otherwise, set dirGroup.
    • +
  • template: Template format for the particular files +output. Allowed values are traditional, +syslog, and modern, or one of the templates +defined in logging_custom_templates. Default to +modern.
    • +

    Global options:

    +

    logging_files_template_format: Set default template for +the files output. Allowed values are traditional, +syslog, and modern, or one of the templates +defined in logging_custom_templates. Default to +modern.

    Note: Selector options and property-based filter options are exclusive. If Property-based filter options are defined, selector options will be ignored.

    Note: Unless the above options are given, these local file outputs are configured.

    -
      kern.*                                      /dev/console
-  *.info;mail.none;authpriv.none;cron.none    /var/log/messages
-  authpriv.*                                  /var/log/secure
-  mail.*                                      -/var/log/maillog
-  cron.*                                      -/var/log/cron
-  *.emerg                                     :omusrmsg:*
-  uucp,news.crit                              /var/log/spooler
-  local7.*
    +
      kern.*                                      /dev/console
+  *.info;mail.none;authpriv.none;cron.none    /var/log/messages
+  authpriv.*                                  /var/log/secure
+  mail.*                                      -/var/log/maillog
+  cron.*                                      -/var/log/cron
+  *.emerg                                     :omusrmsg:*
+  uucp,news.crit                              /var/log/spooler
+  local7.*

    logging_outputs forwards type

    forwards output sends logs to the remote logging system @@ -765,12 +804,15 @@

    logging_outputs forwards *.{{ logging_domain }}
  • template: Template format for the particular forwards output. Allowed values are traditional, -syslog, and modern. Default to +syslog, and modern, or one of the templates +defined in logging_custom_templates. Default to modern.
    • -

    logging_forwards_template_format: Set default template for the -forwards output. Allowed values are traditional, -syslog, and modern. Default to +

    Global options:

    +

    logging_forwards_template_format: Set default template +for the forwards output. Allowed values are traditional, +syslog, and modern, or one of the templates +defined in logging_custom_templates. Default to modern.

    Note: Selector options and property-based filter options are exclusive. If Property-based filter options are defined, @@ -851,33 +893,33 @@

    logging_outputs remote_files

    Note: If both remote_log_path and remote_sub_path are not specified, the remote_file output configured with the following settings.

    -
      template(
-    name="RemoteMessage"
-    type="string"
-    string="/var/log/remote/msg/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
-  )
-  template(
-    name="RemoteHostAuthLog"
-    type="string"
-    string="/var/log/remote/auth/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
-  )
-  template(
-    name="RemoteHostCronLog"
-    type="string"
-    string="/var/log/remote/cron/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
-  )
-  template(
-    name="RemoteHostMailLog"
-    type="string"
-    string="/var/log/remote/mail/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
-  )
-  ruleset(name="unique_remote_files_output_name") {
-    authpriv.*   action(name="remote_authpriv_host_log" type="omfile" DynaFile="RemoteHostAuthLog")
-    *.info;mail.none;authpriv.none;cron.none action(name="remote_message" type="omfile" DynaFile="RemoteMessage")
-    cron.*       action(name="remote_cron_log" type="omfile" DynaFile="RemoteHostCronLog")
-    mail.*       action(name="remote_mail_service_log" type="omfile" DynaFile="RemoteHostMailLog")
-  }
    +
      template(
+    name="RemoteMessage"
+    type="string"
+    string="/var/log/remote/msg/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
+  )
+  template(
+    name="RemoteHostAuthLog"
+    type="string"
+    string="/var/log/remote/auth/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
+  )
+  template(
+    name="RemoteHostCronLog"
+    type="string"
+    string="/var/log/remote/cron/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
+  )
+  template(
+    name="RemoteHostMailLog"
+    type="string"
+    string="/var/log/remote/mail/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log"
+  )
+  ruleset(name="unique_remote_files_output_name") {
+    authpriv.*   action(name="remote_authpriv_host_log" type="omfile" DynaFile="RemoteHostAuthLog")
+    *.info;mail.none;authpriv.none;cron.none action(name="remote_message" type="omfile" DynaFile="RemoteMessage")
+    cron.*       action(name="remote_cron_log" type="omfile" DynaFile="RemoteHostCronLog")
+    mail.*       action(name="remote_mail_service_log" type="omfile" DynaFile="RemoteHostMailLog")
+  }

    Logging_flows options

    -
        logging_certificates:
-      - name: logging_cert
-        dns: ['localhost', 'www.example.com']
-        ca: ipa
    +
        logging_certificates:
+      - name: logging_cert
+        dns: ['localhost', 'www.example.com']
+        ca: ipa

    The created private key and certificate are set with the ca certificate, e.g., in logging_pki_files as follows:

    -
      logging_pki_files:
-    - ca_cert: /etc/ipa/ca.crt
-      cert: /etc/pki/tls/certs/logging_cert.crt
-      private_key: /etc/pki/tls/private/logging_cert.key
    +
      logging_pki_files:
+    - ca_cert: /etc/ipa/ca.crt
+      cert: /etc/pki/tls/certs/logging_cert.crt
+      private_key: /etc/pki/tls/private/logging_cert.key

    or in the relp parameters as follows:

    -
       logging_inputs:
-     - name: relp_server
-       type: relp
-       tls: true
-       ca_cert: /etc/ipa/ca.crt
-       cert: /etc/pki/tls/certs/logging_cert.crt
-       private_key: /etc/pki/tls/private/logging_cert.key
-       [snip]
    +
       logging_inputs:
+     - name: relp_server
+       type: relp
+       tls: true
+       ca_cert: /etc/ipa/ca.crt
+       cert: /etc/pki/tls/certs/logging_cert.crt
+       private_key: /etc/pki/tls/private/logging_cert.key
+       [snip]

    NOTE: The certificate role, unless using IPA and joining the systems to an IPA domain, creates self-signed certificates, so you will need to explicitly configure trust, which is not currently @@ -1053,23 +1095,23 @@

    Update and Delete

    the dictionary to be deleted (in this case, input_nameA and output_name0). And remove the flow dictionary related to the input and output as follows.

    -
    logging_inputs:
-  - name: input_nameA
-    type: input_typeA
-    state: absent
-  - name: input_nameB
-    type: input_typeB
-logging_outputs:
-  - name: output_name0
-    type: output_type0
-    state: absent
-  - name: output_name1
-    type: output_type1
-logging_flows:
-  - name: flow_nameY
-    inputs: [input_nameB]
-    outputs: [output_name1]
    +
    logging_inputs:
+  - name: input_nameA
+    type: input_typeA
+    state: absent
+  - name: input_nameB
+    type: input_typeB
+logging_outputs:
+  - name: output_name0
+    type: output_type0
+    state: absent
+  - name: output_name1
+    type: output_type1
+logging_flows:
+  - name: flow_nameY
+    inputs: [input_nameB]
+    outputs: [output_name1]

    If you want to remove all the configuration files previously configured, in addition to setting state: absent to each logging_inputs and logging_outputs item, add @@ -1077,296 +1119,238 @@

    Update and Delete

    follows. It will eliminate the global and common configuration files, as well. Or, use logging_purge_confs: true to wipe out all previous configuration and replace it with your given configuration.

    -
    logging_enabled: false
-logging_inputs:
-  - name: input_nameA
-    type: input_typeA
-    state: absent
-  - name: input_nameB
-    type: input_typeB
-    state: absent
-logging_outputs:
-  - name: output_name0
-    type: output_type0
-    state: absent
-  - name: output_name1
-    type: output_type1
-    state: absent
-logging_flows:
-  - name: flow_nameY
-    inputs: [input_nameB]
-    outputs: [output_name1]
    +
    logging_enabled: false
+logging_inputs:
+  - name: input_nameA
+    type: input_typeA
+    state: absent
+  - name: input_nameB
+    type: input_typeB
+    state: absent
+logging_outputs:
+  - name: output_name0
+    type: output_type0
+    state: absent
+  - name: output_name1
+    type: output_type1
+    state: absent
+logging_flows:
+  - name: flow_nameY
+    inputs: [input_nameB]
+    outputs: [output_name1]

    Configuration Examples

    Standalone configuration

    Deploying basics input reading logs from systemd journal and implicit files output to write to the local files. This also deploys two custom files to the /etc/rsyslog.d/ directory.

    -
    ---
-- name: Deploying basics input and implicit files output
-  hosts: all
-  roles:
-    - linux-system-roles.logging
-  vars:
-    logging_custom_config_files:
-      - files/90-my-custom-file.conf
-      - files/my-custom-file.rulebase
-    logging_inputs:
-      - name: system_input
-        type: basics
    -

    The following playbook generates the same logging configuration -files.

    -
    ---
-- name: Deploying basics input and files output
-  hosts: all
-  roles:
-    - linux-system-roles.logging
-  vars:
-    logging_custom_config_files:
-      - files/90-my-custom-file.conf
-      - files/my-custom-file.rulebase
-    logging_inputs:
-      - name: system_input
-        type: basics
-    logging_outputs:
-      - name: files_output
-        type: files
-    logging_flows:
-      - name: flow0
-        inputs: [system_input]
-        outputs: [files_output]
    -

    Deploying basics input reading logs from systemd unix -socket and files output to write to the local files.

    ---
-- name: Deploying basics input using systemd unix socket and files output
+- name: Deploying basics input and implicit files output
   hosts: all
   roles:
     - linux-system-roles.logging
   vars:
-    logging_inputs:
-      - name: system_input
-        type: basics
-        use_imuxsock: true
-    logging_outputs:
-      - name: files_output
-        type: files
-    logging_flows:
-      - name: flow0
-        inputs: [system_input]
-        outputs: [files_output]
    -

    Deploying basics input reading logs from systemd journal -and files output to write to the individually configured -local files. This also shows how to specify ownership/permission for log -files/directories created by the logger.

    + logging_custom_config_files: + - files/90-my-custom-file.conf + - files/my-custom-file.rulebase + logging_inputs: + - name: system_input + type: basics +

    The following playbook generates the same logging configuration +files.

    ---
-- name: Deploying basic input and configured files output
+- name: Deploying basics input and files output
   hosts: all
   roles:
     - linux-system-roles.logging
   vars:
-    logging_inputs:
-      - name: system_input
-        type: basics
-    logging_outputs:
-      - name: files_output0
-        type: files
-        severity: info
-        exclude:
-          - authpriv.none
-          - auth.none
-          - cron.none
-          - mail.none
-        path: /var/log/messages
-      - name: files_output1
-        type: files
-        facility: authpriv,auth
-        path: /var/log/secure
-      - name: files_output2
-        type: files
-        severity: info
-        path: /var/log/myapp/my_app.log
-        mode: "0600"
-        owner: logowner
-        group: loggroup
-        dir_mode: "0700"
-        dir_owner: logowner
-        dir_group: loggroup
-    logging_flows:
-      - name: flow0
-        inputs: [system_input]
-        outputs: [files_output0, files_output1]
    -

    Deploying files input reading logs from local files and -files output to write to the individually configured local -files.

    + logging_custom_config_files: + - files/90-my-custom-file.conf + - files/my-custom-file.rulebase + logging_inputs: + - name: system_input + type: basics + logging_outputs: + - name: files_output + type: files + logging_flows: + - name: flow0 + inputs: [system_input] + outputs: [files_output] +

    Deploying basics input reading logs from systemd unix +socket and files output to write to the local files.

    ---
-- name: Deploying files input and configured files output
+- name: Deploying basics input using systemd unix socket and files output
   hosts: all
   roles:
     - linux-system-roles.logging
   vars:
     logging_inputs:
-      - name: files_input0
-        type: files
-        input_log_path: /var/log/containerA/*.log
-      - name: files_input1
-        type: files
-        input_log_path: /var/log/containerB/*.log
-    logging_outputs:
-      - name: files_output0
-        type: files
-        severity: info
-        exclude:
-          - authpriv.none
-          - auth.none
-          - cron.none
-          - mail.none
-        path: /var/log/messages
-      - name: files_output1
-        type: files
-        facility: authpriv,auth
-        path: /var/log/secure
-    logging_flows:
-      - name: flow0
-        inputs: [files_input0, files_input1]
-        outputs: [files_output0, files_output1]
    -

    Deploying files input reading logs from local files and -files output to write to the local files based on the -property-based filters.

    + - name: system_input + type: basics + use_imuxsock: true + logging_outputs: + - name: files_output + type: files + logging_flows: + - name: flow0 + inputs: [system_input] + outputs: [files_output] +

    Deploying basics input reading logs from systemd journal +and files output to write to the individually configured +local files. This also shows how to specify ownership/permission for log +files/directories created by the logger.

    ---
-- name: Deploying files input and configured files output
+- name: Deploying basic input and configured files output
   hosts: all
   roles:
     - linux-system-roles.logging
   vars:
     logging_inputs:
-      - name: files_input0
-        type: files
-        input_log_path: /var/log/containerA/*.log
-      - name: files_input1
+      - name: system_input
+        type: basics
+    logging_outputs:
+      - name: files_output0
         type: files
-        input_log_path: /var/log/containerB/*.log
-    logging_outputs:
-      - name: files_output0
-        type: files
-        property: msg
-        property_op: contains
-        property_value: error
-        path: /var/log/errors.log
-      - name: files_output1
-        type: files
-        property: msg
-        property_op: "!contains"
-        property_value: error
-        path: /var/log/others.log
-    logging_flows:
-      - name: flow0
-        inputs: [files_input0, files_input1]
-        outputs: [files_output0, files_output1]
    -

    Client configuration

    -

    Deploying basics input reading logs from systemd journal -and forwards output to forward the logs to the remote -rsyslog.

    + severity: info + exclude: + - authpriv.none + - auth.none + - cron.none + - mail.none + path: /var/log/messages + - name: files_output1 + type: files + facility: authpriv,auth + path: /var/log/secure + - name: files_output2 + type: files + severity: info + path: /var/log/myapp/my_app.log + mode: "0600" + owner: logowner + group: loggroup + dir_mode: "0700" + dir_owner: logowner + dir_group: loggroup + logging_flows: + - name: flow0 + inputs: [system_input] + outputs: [files_output0, files_output1] +

    Deploying files input reading logs from local files and +files output to write to the individually configured local +files.

    ---
-- name: Deploying basics input and forwards output
-  hosts: clients
+- name: Deploying files input and configured files output
+  hosts: all
   roles:
     - linux-system-roles.logging
   vars:
     logging_inputs:
-      - name: basic_input
-        type: basics
-    logging_outputs:
-      - name: forward_output0
-        type: forwards
-        severity: info
-        target: your_target_hostname
-        udp_port: 514
-      - name: forward_output1
-        type: forwards
-        facility: mail
-        target: your_target_hostname
-        tcp_port: 514
-    logging_flows:
-      - name: flows0
-        inputs: [basic_input]
-        outputs: [forward_output0, forward_output1]
    -

    Deploying files input reading logs from a local file and -forwards output to forward the logs to the remote rsyslog -over tls. Assuming the ca_cert, cert and key files are prepared at the -specified paths on the control host. The files are deployed to the -default location /etc/pki/tls/certs/, -/etc/pki/tls/certs/, and /etc/pki/tls/private, -respectively.

    + - name: files_input0 + type: files + input_log_path: /var/log/containerA/*.log + - name: files_input1 + type: files + input_log_path: /var/log/containerB/*.log + logging_outputs: + - name: files_output0 + type: files + severity: info + exclude: + - authpriv.none + - auth.none + - cron.none + - mail.none + path: /var/log/messages + - name: files_output1 + type: files + facility: authpriv,auth + path: /var/log/secure + logging_flows: + - name: flow0 + inputs: [files_input0, files_input1] + outputs: [files_output0, files_output1] +

    Deploying files input reading logs from local files and +files output to write to the local files based on the +property-based filters.

    ---
-- name: Deploying files input and forwards output with certs
-  hosts: clients
+- name: Deploying files input and configured files output
+  hosts: all
   roles:
     - linux-system-roles.logging
   vars:
-    logging_pki_files:
-      - ca_cert_src: /local/path/to/ca_cert
-        cert_src: /local/path/to/cert
-        private_key_src: /local/path/to/key
-    logging_inputs:
-      - name: files_input
-        type: files
-        input_log_path: /var/log/containers/*.log
-    logging_outputs:
-      - name: forwards_output
-        type: forwards
-        target: your_target_host
-        tcp_port: your_target_port
-        pki_authmode: x509/name
-        permitted_server: '*.example.com'
-    logging_flows:
-      - name: flows0
-        inputs: [basic_input]
-        outputs: [forwards-severity_and_facility]
    -

    Server configuration

    -

    Deploying remote input reading logs from remote rsyslog -and remote_files output to write the logs to the local -files under the directory named by the remote host name.

    + logging_inputs: + - name: files_input0 + type: files + input_log_path: /var/log/containerA/*.log + - name: files_input1 + type: files + input_log_path: /var/log/containerB/*.log + logging_outputs: + - name: files_output0 + type: files + property: msg + property_op: contains + property_value: error + path: /var/log/errors.log + - name: files_output1 + type: files + property: msg + property_op: "!contains" + property_value: error + path: /var/log/others.log + logging_flows: + - name: flow0 + inputs: [files_input0, files_input1] + outputs: [files_output0, files_output1] +

    Client configuration

    +

    Deploying basics input reading logs from systemd journal +and forwards output to forward the logs to the remote +rsyslog.

    ---
-- name: Deploying remote input and remote_files output
-  hosts: server
+- name: Deploying basics input and forwards output
+  hosts: clients
   roles:
     - linux-system-roles.logging
   vars:
     logging_inputs:
-      - name: remote_udp_input
-        type: remote
-        udp_ports: [514, 1514]
-      - name: remote_tcp_input
-        type: remote
-        tcp_ports: [514, 1514]
-    logging_outputs:
-      - name: remote_files_output
-        type: remote_files
-    logging_flows:
-      - name: flow_0
-        inputs: [remote_udp_input, remote_tcp_input]
-        outputs: [remote_files_output]
    -

    Deploying remote input reading logs from remote rsyslog -and remote_files output to write the logs to the configured -local files with the tls setup supporting 20 clients. Assuming the -ca_cert, cert and key files are prepared at the specified paths on the -control host. The files are deployed to the default location -/etc/pki/tls/certs/, /etc/pki/tls/certs/, and -/etc/pki/tls/private, respectively.

    + - name: basic_input + type: basics + logging_outputs: + - name: forward_output0 + type: forwards + severity: info + target: your_target_hostname + udp_port: 514 + - name: forward_output1 + type: forwards + facility: mail + target: your_target_hostname + tcp_port: 514 + logging_flows: + - name: flows0 + inputs: [basic_input] + outputs: [forward_output0, forward_output1] +

    Deploying files input reading logs from a local file and +forwards output to forward the logs to the remote rsyslog +over tls. Assuming the ca_cert, cert and key files are prepared at the +specified paths on the control host. The files are deployed to the +default location /etc/pki/tls/certs/, +/etc/pki/tls/certs/, and /etc/pki/tls/private, +respectively.

    ---
-- name: Deploying remote input and remote_files output with certs
-  hosts: server
+- name: Deploying files input and forwards output with certs
+  hosts: clients
   roles:
     - linux-system-roles.logging
   vars:
@@ -1375,86 +1359,144 @@ 
    Server configuration
    
         cert_src: /local/path/to/cert
         private_key_src: /local/path/to/key
     logging_inputs:
-      - name: remote_tcp_input
-        type: remote
-        tcp_ports: [6514, 7514]
-        permitted_clients: ['*.example.com', '*.test.com']
-    logging_outputs:
-      - name: remote_files_output0
-        type: remote_files
-        remote_log_path: /var/log/remote/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log
-        async_writing: true
-        client_count: 20
-        io_buffer_size: 8192
-      - name: remote_files_output1
-        type: remote_files
-        remote_sub_path: others/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log
-    logging_flows:
-      - name: flow_0
-        inputs: [remote_udp_input, remote_tcp_input]
-        outputs: [remote_files_output0, remote_files_output1]
    -

    Client configuration with -Relp

    -

    Deploying basics input reading logs from systemd journal -and relp output to send the logs to the remote rsyslog over -relp.

    + - name: files_input + type: files + input_log_path: /var/log/containers/*.log + logging_outputs: + - name: forwards_output + type: forwards + target: your_target_host + tcp_port: your_target_port + pki_authmode: x509/name + permitted_server: '*.example.com' + logging_flows: + - name: flows0 + inputs: [basic_input] + outputs: [forwards-severity_and_facility] +

    Server configuration

    +

    Deploying remote input reading logs from remote rsyslog +and remote_files output to write the logs to the local +files under the directory named by the remote host name.

    ---
-- name: Deploying basics input and relp output
-  hosts: clients
+- name: Deploying remote input and remote_files output
+  hosts: server
   roles:
     - linux-system-roles.logging
   vars:
     logging_inputs:
-      - name: basic_input
-        type: basics
-    logging_outputs:
-      - name: relp_client
-        type: relp
-        target: logging.server.com
-        port: 20514
-        tls: true
-        ca_cert_src: /path/to/ca.pem
-        cert_src: /path/to/client-cert.pem
-        private_key_src: /path/to/client-key.pem
-        pki_authmode: name
-        permitted_servers:
-          - '*.server.com'
-    logging_flows:
-      - name: flow
-        inputs: [basic_input]
-        outputs: [relp_client]
    -

    Server configuration with -Relp

    -

    Deploying relp input reading logs from remote rsyslog -and remote_files output to write the logs to the local -files under the directory named by the remote host name.

    + - name: remote_udp_input + type: remote + udp_ports: [514, 1514] + - name: remote_tcp_input + type: remote + tcp_ports: [514, 1514] + logging_outputs: + - name: remote_files_output + type: remote_files + logging_flows: + - name: flow_0 + inputs: [remote_udp_input, remote_tcp_input] + outputs: [remote_files_output] +

    Deploying remote input reading logs from remote rsyslog +and remote_files output to write the logs to the configured +local files with the tls setup supporting 20 clients. Assuming the +ca_cert, cert and key files are prepared at the specified paths on the +control host. The files are deployed to the default location +/etc/pki/tls/certs/, /etc/pki/tls/certs/, and +/etc/pki/tls/private, respectively.

    ---
-- name: Deploying remote input and remote_files output
+- name: Deploying remote input and remote_files output with certs
   hosts: server
   roles:
     - linux-system-roles.logging
   vars:
-    logging_inputs:
-      - name: relp_server
-        type: relp
-        port: 20514
-        tls: true
-        ca_cert_src: /path/to/ca.pem
-        cert_src: /path/to/server-cert.pem
-        private_key_src: /path/to/server-key.pem
-        pki_authmode: name
-        permitted_clients:
-          - '*.client.com'
-          - '*.example.com'
-    logging_outputs:
-      - name: remote_files_output
-        type: remote_files
-    logging_flows:
-      - name: flow
-        inputs: [relp_server]
-        outputs: [remote_files_output]
    + logging_pki_files: + - ca_cert_src: /local/path/to/ca_cert + cert_src: /local/path/to/cert + private_key_src: /local/path/to/key + logging_inputs: + - name: remote_tcp_input + type: remote + tcp_ports: [6514, 7514] + permitted_clients: ['*.example.com', '*.test.com'] + logging_outputs: + - name: remote_files_output0 + type: remote_files + remote_log_path: /var/log/remote/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log + async_writing: true + client_count: 20 + io_buffer_size: 8192 + - name: remote_files_output1 + type: remote_files + remote_sub_path: others/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log + logging_flows: + - name: flow_0 + inputs: [remote_udp_input, remote_tcp_input] + outputs: [remote_files_output0, remote_files_output1] +

    Client configuration with +Relp

    +

    Deploying basics input reading logs from systemd journal +and relp output to send the logs to the remote rsyslog over +relp.

    +
    ---
+- name: Deploying basics input and relp output
+  hosts: clients
+  roles:
+    - linux-system-roles.logging
+  vars:
+    logging_inputs:
+      - name: basic_input
+        type: basics
+    logging_outputs:
+      - name: relp_client
+        type: relp
+        target: logging.server.com
+        port: 20514
+        tls: true
+        ca_cert_src: /path/to/ca.pem
+        cert_src: /path/to/client-cert.pem
+        private_key_src: /path/to/client-key.pem
+        pki_authmode: name
+        permitted_servers:
+          - '*.server.com'
+    logging_flows:
+      - name: flow
+        inputs: [basic_input]
+        outputs: [relp_client]
    +

    Server configuration with +Relp

    +

    Deploying relp input reading logs from remote rsyslog +and remote_files output to write the logs to the local +files under the directory named by the remote host name.

    +
    ---
+- name: Deploying remote input and remote_files output
+  hosts: server
+  roles:
+    - linux-system-roles.logging
+  vars:
+    logging_inputs:
+      - name: relp_server
+        type: relp
+        port: 20514
+        tls: true
+        ca_cert_src: /path/to/ca.pem
+        cert_src: /path/to/server-cert.pem
+        private_key_src: /path/to/server-key.pem
+        pki_authmode: name
+        permitted_clients:
+          - '*.client.com'
+          - '*.example.com'
+    logging_outputs:
+      - name: remote_files_output
+        type: remote_files
+    logging_flows:
+      - name: flow
+        inputs: [relp_server]
+        outputs: [remote_files_output]

    Port Managed by Firewall and SELinux Role

    When a port is specified in the logging role configuration, the @@ -1465,17 +1507,17 @@

    Port Managed by associated TLS value.

    You can verify the changes by the following command-line.

    For firewall,

    -
    firewall-cmd --list-port
    +
    firewall-cmd --list-port

    For SELinux,

    -
    semanage port --list | grep "syslog"
    +
    semanage port --list | grep "syslog"

    The newly specified port will be added to this default set.

    -
    syslog_tls_port_t     tcp   6514, 10514
-syslog_tls_port_t     udp   6514, 10514
-syslogd_port_t        tcp   601, 20514
-syslogd_port_t        udp   514, 601, 20514
    +
    syslog_tls_port_t     tcp   6514, 10514
+syslog_tls_port_t     udp   6514, 10514
+syslogd_port_t        tcp   601, 20514
+syslogd_port_t        udp   514, 601, 20514

    Providers