Skip to content

syslog: generate ruleset and template from simple(r) yaml config - #668

Open
baszoetekouw wants to merge 25 commits into
mainfrom
feature/rsyslog-simplify
Open

syslog: generate ruleset and template from simple(r) yaml config#668
baszoetekouw wants to merge 25 commits into
mainfrom
feature/rsyslog-simplify

Conversation

@baszoetekouw

Copy link
Copy Markdown
Member

No description provided.

@baszoetekouw
baszoetekouw requested a review from crosmuller May 6, 2026 15:48
@baszoetekouw baszoetekouw self-assigned this May 6, 2026
@baszoetekouw

This comment was marked as outdated.

@baszoetekouw
baszoetekouw force-pushed the feature/rsyslog-simplify branch from e736c4d to d389737 Compare May 7, 2026 13:24
@baszoetekouw

Copy link
Copy Markdown
Member Author

Na de vakantie even opkuisen en mergen.

@baszoetekouw
baszoetekouw force-pushed the feature/rsyslog-simplify branch 2 times, most recently from 1b795e7 to c06d499 Compare August 17, 2026 13:37
@baszoetekouw
baszoetekouw force-pushed the feature/rsyslog-simplify branch from 7d94738 to 6af2d27 Compare August 27, 2026 12:01
@baszoetekouw

Copy link
Copy Markdown
Member Author

Templates zijn vervangen door expliciete filenames voor de gevallen dat we helemaal geen template vars gebruikten. Dat maakt het allemaal een stuk overzichterlijker. Ook helpt dat we nu een consistente syntax gebruiken.

Effectieve diff van de rules is dit:

# effectieve diff:
# remove almost all templates:
--- before: /etc/rsyslog.d/templates/test2_sc.conf
+++ after: /home/bas/.ansible/tmp/ansible-local-1019909gkl29kl2/tmpj7zu5kqh/sc_template.conf.j2
@@ -1,67 +1,6 @@
-$template aa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/aa/aa.log"
-$template apache-aa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/aa/apache.log"
-$template apache-aalink-test2_sc, "/opt/surfconext/logs/apps/test2_sc/link/apache.log"
-$template dashboard-test2_sc, "/opt/surfconext/logs/apps/test2_sc/dashboard/dashboard.log"
-$template apache-dashboard-test2_sc, "/opt/surfconext/logs/apps/test2_sc/dashboard/apache.log"
-$template eb-api-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eb-api/eb-api.log"
-$template apache-eb-api-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eb-api/apache.log"
-$template manage-test2_sc, "/opt/surfconext/logs/apps/test2_sc/manage/manage.log"
-$template apache-manage-test2_sc, "/opt/surfconext/logs/apps/test2_sc/manage/apache.log"
-$template pdp-test2_sc, "/opt/surfconext/logs/apps/test2_sc/pdp/pdp.log"
-$template pdpanalytics-test2_sc, "/opt/surfconext/logs/apps/test2_sc/pdp/pdpanalytics.log"
-$template apache-pdp-test2_sc, "/opt/surfconext/logs/apps/test2_sc/pdp/apache.log"
-$template profile-test2_sc, "/opt/surfconext/logs/apps/test2_sc/profile/profile.log"
-$template apache-profile-test2_sc, "/opt/surfconext/logs/apps/test2_sc/profile/apache.log"
-$template voot-test2_sc, "/opt/surfconext/logs/apps/test2_sc/voot/voot.log"
-$template apache-voot-test2_sc, "/opt/surfconext/logs/apps/test2_sc/voot/apache.log"
-$template galera-test2_sc, "/opt/surfconext/logs/apps/test2_sc/galera/galera.log"
-$template garb-test2_sc, "/opt/surfconext/logs/apps/test2_sc/galera/galera_garb.log"
-$template keepalived-test2_sc, "/opt/surfconext/logs/apps/test2_sc/keepalived/keepalived.log"
-$template mongo-test2_sc, "/opt/surfconext/logs/apps/test2_sc/mongo/mongo.log"
-$template apache-static-test2_sc, "/opt/surfconext/logs/apps/test2_sc/static/apache.log"
-$template apache-eb-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eb/apache.log"
-$template eblog-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eb/eb.log"
-$template apache-metadata-test2_sc, "/opt/surfconext/logs/apps/test2_sc/metadata/apache.log"
-$template ebauth-test2_sc, "/opt/surfconext/logs/log_logins/test2_sc/eb-authentication.log"
-$template oidcng-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidcng/oidcng.log"
-$template oidcngjson-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidcng/oidcngjson.log"
-$template apache-oidcng-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidcng/apache.log"
-$template oidc-playground-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidc-playground/oidc-playground.log"
-$template apache-oidcplayground-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidc-playground/oidc-playground-apache.log"
-$template myconext-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/myconext.log"
-$template myconextjson-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/myconextjson.log"
-$template apache-myconext-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/myconext-apache.log"
-$template apache-account-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/account-apache.log"
-$template apache-servicedesk-test2_sc, "/opt/surfconext/logs/apps/test2_sc/servicedeskgui/servicedesk-apache.log
-$template apache-eduid-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/eduid-apache.log"
-$template spdashboard-test2_sc, "/opt/surfconext/logs/apps/test2_sc/spdashboard/spdashboard.log"
-$template apache-spdashboard-test2_sc, "/opt/surfconext/logs/apps/test2_sc/spdashboard/apache.log"
-$template inviteclient-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite//inviteclient.log"
-$template invitewelcome-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite//invitewelcome.log"
-$template inviteserver-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite//inviteserver.log"
-$template invitejson-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite/invitejson.log"
-$template inviteprovisioningmock-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite//inviteprovisioningmock.log"
-$template loadbalancer-test2_sc, "/opt/surfconext/logs/apps/test2_sc/traefik/traefik.log"
 $template auditd-test2_sc, "/opt/surfconext/logs/apps/test2_sc/auditd/%HOSTNAME%/auditd.log"
 $template bash-test2_sc, "/opt/surfconext/logs/apps/test2_sc/bash/%HOSTNAME%/bash.log"
 $template secure-test2_sc, "/opt/surfconext/logs/apps/test2_sc/secure/%HOSTNAME%/secure.log"
 $template MARK-test2_sc, "/opt/surfconext/logs/monitoring/%HOSTNAME%"
+
 $template hostleft-test2_sc, "/opt/surfconext/logs/hosts/test2_sc/%HOSTNAME%/%SYSLOGFACILITY-TEXT%"


# en vervang die door directe filenames:
# templates repeated here for clarity. Zaten dus eigenlijk in de file hierboven
--- before: /etc/rsyslog.d/rulesets/test2_sc.conf
+++ after: /home/bas/.ansible/tmp/ansible-local-10218660o8wswmm/tmpm_2h9anf/sc_ruleset.conf.j2
@@ -1,90 +1,103 @@
-$RuleSet test2_sc
+ruleset(name="test2_sc") {

-if $programname == "engineblock" and $msg startswith " engine" then { action(type="omfile" DynaFile="apache-eb-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "engineblock" and $msg startswith "engine" then { action(type="omfile" DynaFile="apache-eb-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "engineblock" and $msg contains '{"channel":"authentication"' then { action(type="omfile" DynaFile="ebauth-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop  }
-:programname, isequal, "engineblock" { action(type="omfile" DynaFile="eblog-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "EBLOG" { action(type="omfile" DynaFile="eblog-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-EB" { action(type="omfile" DynaFile="apache-eb-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "EBAUTH" { action(type="omfile" DynaFile="ebauth-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-EBAPI" { action(type="omfile" DynaFile="apache-eb-api-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "engineblock" and $msg contains '"channel":"authentication"' then { action(type="omfile" File="/opt/surfconext/logs/log_logins/test2_sc/eb-authentication.log") stop }
+  if $programname == "engineblock" and $msg startswith 'engine' then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb/apache.log") stop }
+  if $programname == "Apache-EB" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb/apache.log") stop }
+  if $programname == "engineblock" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb/eb.log") stop }
+  if $programname == "EBLOG" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb/eb.log") stop }
+  if $programname == "Apache-EBAPI" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb-api/apache.log") stop }

-$template haproxy-test2_sc, "/opt/surfconext/logs/apps/test2_sc/haproxy/haproxy.log"
-:programname, isequal, "haproxy" { action(type="omfile" DynaFile="haproxy-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "haproxy" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/haproxy/haproxy.log") stop }
+  if $programname == "acme.sh" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/haproxy/acme.log") stop }

-:programname, isequal, "aaserver" { action(type="omfile" DynaFile="aa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "aagui" { action(type="omfile" DynaFile="apache-aa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "aalink" { action(type="omfile" DynaFile="apache-aa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "aaserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/aa/aa.log") stop }
+  if $programname == "aagui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/aa/apache.log") stop }
+  if $programname == "aalink" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/aa/apache.log") stop }

-:programname, isequal, "dashboardgui" { action(type="omfile" DynaFile="apache-dashboard-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "dashboardserver" { action(type="omfile" DynaFile="dashboard-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "dashboardgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/dashboard/apache.log") stop }
+  if $programname == "dashboardserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/dashboard/dashboard.log") stop }

-:programname, isequal, "manageserver" { action(type="omfile" DynaFile="manage-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "managegui" { action(type="omfile" DynaFile="apache-manage-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "manageserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/manage/manage.log") stop }
+  if $programname == "managegui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/manage/apache.log") stop }

-:programname, isequal, "pdp" { action(type="omfile" DynaFile="pdp-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "pdp" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/pdp/pdp.log") stop }

-if $programname == "profile" and $msg startswith "{" then { action(type="omfile" DynaFile="profile-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "profile" { action(type="omfile" DynaFile="apache-profile-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "profile" and $msg startswith '{' then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/profile/profile.log") stop }
+  if $programname == "profile" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/profile/apache.log") stop }

-:programname, isequal, "vootserver" { action(type="omfile" DynaFile="voot-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "vootserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/voot/voot.log") stop }

-:programname, isequal, "mariadbd" { action(type="omfile" DynaFile="galera-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "mariadb" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/galera/galera.log") stop }

-:programname, isequal, "garb-systemd" { action(type="omfile" DynaFile="haproxy-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Keepalived_vrrp" { action(type="omfile" DynaFile="keepalived-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "garb-systemd" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/galera/galera_garb.log") stop }
+  if $programname == "Keepalived_vrrp" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/keepalived/keepalived.log") stop }

-:programname, startswith, "mongo" { action(type="omfile" DynaFile="mongo-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "mongod" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/mongo/mongo.log") stop }

-:programname, isequal, "Apache-STATIC" { action(type="omfile" DynaFile="apache-static-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-METADATA" { action(type="omfile" DynaFile="apache-metadata-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "Apache-STATIC" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/static/apache.log") stop }
+  if $programname == "Apache-METADATA" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/metadata/apache.log") stop }

-:programname, isequal, "oidcngserver" { action(type="omfile" DynaFile="oidcng-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "oidcngjson" { action(type="omfile" DynaFile="oidcngjson-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "oidcplaygroundserver" { action(type="omfile" DynaFile="oidc-playground-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "oidcplaygroundgui" { action(type="omfile" DynaFile="apache-oidcplayground-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "oidcngserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/oidcng/oidcng.log") stop }
+  if $programname == "oicdngjson" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/oidcng/oidcngjson.log") stop }
+  if $programname == "oidcplaygroundserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/oidc-playground/oidc-playground.log") stop }
+  if $programname == "oidcplaygroundgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/oidc-playground/oidc-playground-apache.log") stop }

-:programname, isequal, "myconextserver" { action(type="omfile" DynaFile="myconext-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "myconextjson" { action(type="omfile" DynaFile="myconextjson-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "myconextgui" { action(type="omfile" DynaFile="apache-myconext-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "accountgui" { action(type="omfile" DynaFile="apache-account-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "servicedeskgui" { action(type="omfile" DynaFile="apache-servicedesk-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "myconextserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/myconext.log") stop }
+  if $programname == "myconextjson" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/myconextjson.log") stop }
+  if $programname == "myconextgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/myconext-apache.log") stop }
+  if $programname == "accountgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/account-apache.log") stop }
+  if $programname == "servicedeskgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/servicedesk-apache.log") stop }

-:programname, startswith, "inviteclient" { action(type="omfile" DynaFile="inviteclient-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, startswith, "invitewelcome" { action(type="omfile" DynaFile="invitewelcome-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, startswith, "inviteserver" { action(type="omfile" DynaFile="inviteserver-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "invitejson" { action(type="omfile" DynaFile="invitejson-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, startswith, "inviteprovisioningmock" { action(type="omfile" DynaFile="inviteprovisioningmock-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "inviteclient" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/inviteclient.log") stop }
+  if $programname == "invitewelcome" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/invitewelcome.log") stop }
+  if $programname == "inviteserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/inviteserver.log") stop }
+  if $programname == "invitejson" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/invitejson.log") stop }
+  if $programname == "inviteprovisioningmock" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/inviteprovisioningmock.log") stop }

-:programname, startswith, "loadbalancer" { action(type="omfile" DynaFile="loadbalancer-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "loadbalancer" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/traefik/traefik.log") stop }

-if $programname == "gateway" and $msg contains '{"message":"Second Factor Authenticated"' then { action(type="omfile" DynaFile="stepup-authentication-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "gateway" and $msg contains '{"message":"Intrinsic Loa Requested"' then { action(type="omfile" DynaFile="stepup-authentication-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "gateway" and $msg contains '"message":"Second Factor Authenticated"' then { action(type="omfile" File="/opt/surfconext/logs/log_logins/test2_sc/stepup-authentication.log") stop }
+  if $programname == "gateway" and $msg contains '"message":"Intrinsic Loa Requested"' then { action(type="omfile" File="/opt/surfconext/logs/log_logins/test2_sc/stepup-authentication.log") stop }

## Stepup

-$template stepup-authentication-test2_sc, "/opt/surfconext/logs/log_logins/test2_sc/stepup-authentication.log"
-:programname, isequal, "stepup-authentication" { action(type="omfile" DynaFile="stepup-authentication-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "stepup-authentication" then { action(type="omfile" File="/opt/surfconext/logs/log_logins/test2_sc/stepup-authentication.log") stop }

-$template stepup-gateway-test2_sc, "/opt/surfconext/logs/apps/test2_sc/gateway/gateway.log
-$template apache-gateway-test2_sc, "/opt/surfconext/logs/apps/test2_sc/gateway/gateway-apache.log
-:programname, isequal, "stepup-gateway" { action(type="omfile" DynaFile="stepup-gateway-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "gateway" and $msg startswith "gateway" then { action(type="omfile" DynaFile="apache-gateway-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "gateway" { action(type="omfile" DynaFile="stepup-gateway-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-gateway" { action(type="omfile" DynaFile="apache-gateway-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-selfservice" { action(type="omfile" DynaFile="stepup-selfservice-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  ## stepup# gateway
+  if $programname == "stepup-gateway" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/gateway/gateway.log") stop }
+  if $programname == "gateway" and $msg startswith "gateway" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/gateway/gateway-apache.log") stop }
+  if $programname == "gateway" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/gateway/gateway.log") stop }
+  if $programname == "Apache-gateway" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/gateway/gateway-apache.log") stop }

-$template stepup-selfservice-test2_sc, "/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice.log
-$template apache-selfservice-test2_sc, "/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice-apache.log
-if $programname == "selfservice" and $msg startswith "selfservice" then { action(type="omfile" DynaFile="apache-selfservice-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "selfservice" { action(type="omfile" DynaFile="stepup-selfservice-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-selfservice" { action(type="omfile" DynaFile="apache-selfservice-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-ra" { action(type="omfile" DynaFile="stepup-ra-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }

+  # selfservice
+  if $programname == "stepup-selfservice" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice.log") stop }
+  if $programname == "selfservice" and $msg startswith "selfservice" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice-apache.log") stop }
+  if $programname == "selfservice" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice.log") stop }
+  if $programname == "Apache-selfservice" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice-apache.log") stop }

-$template stepup-ra-test2_sc, "/opt/surfconext/logs/apps/test2_sc/ra/ra.log
-$template apache-ra-test2_sc, "/opt/surfconext/logs/apps/test2_sc/ra/ra-apache.log
-if $programname == "ra" and $msg startswith "ra" then { action(type="omfile" DynaFile="apache-ra-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "ra" { action(type="omfile" DynaFile="stepup-ra-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-ra" { action(type="omfile" DynaFile="apache-ra-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-middleware" { action(type="omfile" DynaFile="stepup-middleware-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  # ra
+  if $programname == "stepup-ra" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/ra/ra.log") stop }
+  if $programname == "ra" and $msg startswith "ra" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/ra/ra-apache.log") stop }
+  if $programname == "ra" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/ra/ra.log") stop }
+  if $programname == "Apache-ra" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/ra/ra-apache.log") stop }

-$template stepup-middleware-test2_sc, "/opt/surfconext/logs/apps/test2_sc/middleware/middleware.log
-$template apache-middleware-test2_sc, "/opt/surfconext/logs/apps/test2_sc/middleware/middleware-apache.log
-if $programname == "middleware" and $msg startswith "middleware" then { action(type="omfile" DynaFile="apache-middleware-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "middleware" { action(type="omfile" DynaFile="stepup-middleware-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-middleware" { action(type="omfile" DynaFile="apache-middleware-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-webauthn" { action(type="omfile" DynaFile="stepup-webauthn-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  # middleware
+  if $programname == "stepup-middleware" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/middleware/middleware.log") stop }
+  if $programname == "middleware" and $msg startswith "middleware" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/middleware/middleware-apache.log") stop }
+  if $programname == "middleware" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/middleware/middleware.log") stop }
+  if $programname == "Apache-middleware" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/middleware/middleware-apache.log") stop }

-$template stepup-webauthn-test2_sc, "/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn.log
-$template apache-webauthn-test2_sc, "/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn-apache.log
-if $programname == "webauthn" and $msg startswith "webauthn" then { action(type="omfile" DynaFile="apache-webauthn-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "webauthn" { action(type="omfile" DynaFile="stepup-webauthn-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-webauthn" { action(type="omfile" DynaFile="apache-webauthn-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-tiqr" { action(type="omfile" DynaFile="stepup-tiqr-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  # webauthn
+  if $programname == "stepup-webauthn" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn.log") stop }
+  if $programname == "webauthn" and $msg startswith "webauthn" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn-apache.log") stop }
+  if $programname == "webauthn" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn.log") stop }
+  if $programname == "Apache-webauthn" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn-apache.log") stop }

-$template stepup-tiqr-test2_sc, "/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr.log
-$template apache-tiqr-test2_sc, "/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr-apache.log
-if $programname == "tiqr" and $msg startswith "tiqr" then { action(type="omfile" DynaFile="apache-tiqr-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "tiqr" { action(type="omfile" DynaFile="stepup-tiqr-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-tiqr" { action(type="omfile" DynaFile="apache-tiqr-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-azure-mfa" { action(type="omfile" DynaFile="stepup-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  # tiqr
+  if $programname == "stepup-tiqr" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr.log") stop }
+  if $programname == "tiqr" and $msg startswith "tiqr" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr-apache.log") stop }
+  if $programname == "tiqr" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr.log") stop }
+  if $programname == "Apache-tiqr" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr-apache.log") stop }

-$template stepup-azure-mfa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa.log
-$template apache-azure-mfa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa-apache.log
-:programname, isequal, "azure-mfa" { action(type="omfile" DynaFile="stepup-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-azure-mfa" { action(type="omfile" DynaFile="apache-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-azuremfa" { action(type="omfile" DynaFile="stepup-azuremfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  # azure-mfa
+  if $programname == "stepup-azure-mfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa.log") stop }
+  if $programname == "azure-mfa" and $msg startswith "azure-mfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa-apache.log") stop }
+  if $programname == "azure-mfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa.log") stop }
+  if $programname == "Apache-azure-mfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa-apache.log") stop }

-$template stepup-azuremfa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa.log
-$template apache-azuremfa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa-apache.log
-if $programname == "azure-mfa" and $msg startswith "azure-mfa" then { action(type="omfile" DynaFile="apache-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "azuremfa" and $msg startswith "azuremfa" then { action(type="omfile" DynaFile="apache-azuremfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "azuremfa" { action(type="omfile" DynaFile="stepup-azuremfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-azuremfa" { action(type="omfile" DynaFile="apache-azuremfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-azuremfa" { action(type="omfile" DynaFile="apache-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  # azuremfa
+  if $programname == "stepup-azuremfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa.log") stop }
+  if $programname == "azuremfa" and $msg startswith "azuremfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa-apache.log") stop }
+  if $programname == "azuremfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa.log") stop }
+  if $programname == "Apache-azuremfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa-apache.log") stop }

-if $programname == "spdashboard" and $msg startswith "spdashboard" then { action(type="omfile" DynaFile="apache-spdashboard-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "spdashboard" { action(type="omfile" DynaFile="spdashboard-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+  if $programname == "spdashboard" and $msg startswith 'spdashboard' then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/spdashboard/spdashboard.log") stop }
+  if $programname == "spdashboard" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/spdashboard/apache.log") stop }


-:programname, isequal, "audispd" { action(type="omfile" DynaFile="auditd-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "audit" { action(type="omfile" DynaFile="auditd-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "audisp-syslog" { action(type="omfile" DynaFile="auditd-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "-bash" { action(type="omfile" DynaFile="bash-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:syslogfacility-text, isequal, "authpriv" { action(type="omfile" dynafile="secure-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:msg, contains, "-- MARK --" { action(type="omfile" DynaFile="MARK-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-*.* ?hostleft-test2_sc
+  # per-host specials
+  if $programname == "audispd"       then { action(type="omfile" DynaFile="auditd-test2_sc") stop }
+  if $programname == "audit"         then { action(type="omfile" DynaFile="auditd-test2_sc") stop }
+  if $programname == "audisp-syslog" then { action(type="omfile" DynaFile="auditd-test2_sc") stop }
+  if $programname == "-bash"         then { action(type="omfile" DynaFile="bash-test2_sc") stop }
+  if $programname == "authpriv"      then { action(type="omfile" Dynafile="secure-test2_sc") stop }
+  if $msg contains "-- MARK --"      then { action(type="omfile" DynaFile="MARK-test2_sc") stop }

+  # default action
+  action(type="omfile" dynaFile="hostleft-test2_sc")
+  stop
+}

@baszoetekouw
baszoetekouw force-pushed the feature/rsyslog-simplify branch from 34c436a to b7c987d Compare August 27, 2026 13:26
@baszoetekouw

Copy link
Copy Markdown
Member Author

Effective diff for regular hosts:

--- before: /etc/rsyslog.conf
+++ after: /home/bas/.ansible/tmp/ansible-local-1025701lkqp64do/tmp5mgco37z/rsyslog.conf.j2
@@ -1,41 +1,94 @@
+#### MODULES ####

+## input modules
+# This module provides the ability to accept syslog messages from applications running on the local system via Unix sockets
+module(load="imuxsock"
+       syssock.use="off" # Turn off message reception via local log socket; local messages are retrieved through imjournal now.
+)

+# for docker hosts, we support logging directly from inside the docker host to a TCP socket on the container host
+# Provides the ability to receive syslog messages via TCP
-module(load="imptcp")
-input(type="imptcp" port="514")

+# Provides the ability to import structured log messages from systemd journal to syslog.
-module(load="imjournal"             # provides access to the systemd journal
+module(load="imjournal"
        UsePid="system" # PID number is retrieved as the ID of the process the journal entry originates from
        StateFile="imjournal.state"
        ratelimit.interval="60"
-       ratelimit.burst="20000")  # Reads journald logs
+       ratelimit.burst="20000"
+)

+# Reads messages from the kernel log and submits them to the syslog engine.
-module(load="imklog")   # provides kernel logging support
+module(load="imklog")

+# This module provides the ability to inject periodic “mark” messages to the input of rsyslog.
-module(load="immark" interval="300" )  # provides --MARK-- message capability
+module(load="immark"
+       interval="300"
+       writeallmarkmessages="on"
+)

+## output modules
+# This module supports sending syslog messages over the reliable RELP protocol
 module(load="omrelp")

+# The omfile plug-in provides the core functionality of writing messages to files residing inside the local file system
+module(load="builtin:omfile"
+       template="RSYSLOG_TraditionalFileFormat" # Use default timestamp format
+       dirCreateMode="0755" DirOwner="root" DirGroup="root" fileCreateMode="0640" FileOwner="root" FileGroup="adm"
+            # Set default file permission
+)


+#### GLOBAL DIRECTIVES ####

-# Where to place auxiliary files
-global(workDirectory="/var/spool/rsyslog")
+# where to place aux file (spool, etc)
+global(workDirectory="/var/lib/rsyslog")

+# Support large messages
-$MaxMessageSize 32k
+global(maxMessageSize="32k")

+# Keep fully qualified hostnames instead of stripping the local domain.
-$PreserveFQDN on
+global(preserveFQDN="on")


+#### LOCAL TEMPLATES AND RULES ####

+## templates
-template(name="CustomRelpFormat" type="string"
-  string="<%PRI%>%TIMESTAMP% docker1.test2.ams.surfconext.nl %syslogtag%%msg%\n")
+template(name="CustomRelpFormat"
+         type="string"
+         string="<%PRI%>%TIMESTAMP% docker1.test2.ams.surfconext.nl %syslogtag%%msg%\n"
+)

+## rules
+## this is the default ruleset, used for local messages

+# emergency messages to the console
-*.emerg                         :omusrmsg:*
+if prifilt("*.emerg") then {
+    action(type="omusrmsg" users="*")
+}

-# Logs are forwarded to syslog_log1_test2
+# all other local logs are forwarded to syslog_log1_test2
 action(type="omrelp"
-target="syslog.test2.surfconext.nl"
-port="5140"
-tls="on"
-tls.caCert="/etc/pki/rsyslog/rsyslogclientca.crt"
-tls.MyCert="/etc/pki/rsyslog/rsyslogclient.crt"
-tls.MyPrivKey="/etc/pki/rsyslog/rsyslogclient.key"
-tls.authmode="name"
-tls.permittedpeer=["syslog.test2.surfconext.nl"]
-queue.type="LinkedList"
-queue.filename="syslog_log1_test2"
-queue.spoolDirectory="/var/spool/rsyslog"
-queue.maxdiskspace="1G"
-queue.saveonshutdown="on"
-action.resumeRetryCount="-1"
-action.resumeInterval="5"
-action.writeAllMarkMessages="on"
-template="CustomRelpFormat")
+       target="syslog.test2.surfconext.nl"
+       port="5140"
+       tls="on"
+       tls.caCert="/etc/pki/rsyslog/rsyslog_ca.pem"
+       tls.MyCert="/etc/pki/rsyslog/rsyslogclient.crt"
+       tls.MyPrivKey="/etc/pki/rsyslog/rsyslogclient.key"
+       tls.authmode="name"
+       tls.permittedpeer=["syslog.test2.surfconext.nl"]
+       queue.type="LinkedList"
+       queue.filename="syslog_log1_test2"
+       queue.spoolDirectory="/var/spool/rsyslog"
+       queue.maxdiskspace="1G"
+       queue.saveonshutdown="on"
+       action.resumeRetryCount="-1"
+       action.resumeInterval="5"
+       action.writeAllMarkMessages="on"
+       template="CustomRelpFormat"
+)

+# stop processing local messages
+stop

@baszoetekouw

Copy link
Copy Markdown
Member Author

@baszoetekouw

Copy link
Copy Markdown
Member Author

Ik twijfel nog over deze:

+## input modules
+# This module provides the ability to accept syslog messages from applications running on the local system via Unix sockets
+module(load="imuxsock"
+       syssock.use="off" # Turn off message reception via local log socket; local messages are retrieved through imjournal now.
+)

volgens de docs is die niet meer nodig op systemd-enabled servers. Zie

Echter, op de central logserver staat deze momenteel wel aan (specifiek met de $OmitLocalLogging on setting, equivalend met syssock.use="off").

@crosmuller

Copy link
Copy Markdown
Contributor

Ik twijfel nog over deze:

+## input modules
+# This module provides the ability to accept syslog messages from applications running on the local system via Unix sockets
+module(load="imuxsock"
+       syssock.use="off" # Turn off message reception via local log socket; local messages are retrieved through imjournal now.
+)

volgens de docs is die niet meer nodig op systemd-enabled servers. Zie

* https://www.rsyslog.com/files/temp/doc-indent/configuration/modules/imuxsock.html#systemd-details-label-original

* https://www.rsyslog.com/files/temp/doc-indent/configuration/modules/imuxsock.html#systemd-details-label-original

Echter, op de central logserver staat deze momenteel wel aan (specifiek met de $OmitLocalLogging on setting, equivalend met syssock.use="off").

gewoon even uitproberen op test2?

@baszoetekouw baszoetekouw mentioned this pull request Aug 28, 2026
@baszoetekouw

Copy link
Copy Markdown
Member Author

De logservers hebben idd een syslog.socket unit die de socket regelt

[Socket]
ListenDatagram=/run/systemd/journal/syslog
SocketMode=0666
PassCredentials=yes
PassSecurity=yes
ReceiveBuffer=8M

@baszoetekouw
baszoetekouw force-pushed the feature/rsyslog-simplify branch from c02cb09 to b183554 Compare August 28, 2026 12:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants