syslog: generate ruleset and template from simple(r) yaml config - #668
syslog: generate ruleset and template from simple(r) yaml config#668baszoetekouw wants to merge 25 commits into
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
e736c4d to
d389737
Compare
|
Na de vakantie even opkuisen en mergen. |
1b795e7 to
c06d499
Compare
7d94738 to
6af2d27
Compare
|
Templates zijn vervangen door expliciete filenames voor de gevallen dat we helemaal geen template vars gebruikten. Dat maakt het allemaal een stuk overzichterlijker. Ook helpt dat we nu een consistente syntax gebruiken. Effectieve diff van de rules is dit: # effectieve diff:
# remove almost all templates:
--- before: /etc/rsyslog.d/templates/test2_sc.conf
+++ after: /home/bas/.ansible/tmp/ansible-local-1019909gkl29kl2/tmpj7zu5kqh/sc_template.conf.j2
@@ -1,67 +1,6 @@
-$template aa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/aa/aa.log"
-$template apache-aa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/aa/apache.log"
-$template apache-aalink-test2_sc, "/opt/surfconext/logs/apps/test2_sc/link/apache.log"
-$template dashboard-test2_sc, "/opt/surfconext/logs/apps/test2_sc/dashboard/dashboard.log"
-$template apache-dashboard-test2_sc, "/opt/surfconext/logs/apps/test2_sc/dashboard/apache.log"
-$template eb-api-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eb-api/eb-api.log"
-$template apache-eb-api-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eb-api/apache.log"
-$template manage-test2_sc, "/opt/surfconext/logs/apps/test2_sc/manage/manage.log"
-$template apache-manage-test2_sc, "/opt/surfconext/logs/apps/test2_sc/manage/apache.log"
-$template pdp-test2_sc, "/opt/surfconext/logs/apps/test2_sc/pdp/pdp.log"
-$template pdpanalytics-test2_sc, "/opt/surfconext/logs/apps/test2_sc/pdp/pdpanalytics.log"
-$template apache-pdp-test2_sc, "/opt/surfconext/logs/apps/test2_sc/pdp/apache.log"
-$template profile-test2_sc, "/opt/surfconext/logs/apps/test2_sc/profile/profile.log"
-$template apache-profile-test2_sc, "/opt/surfconext/logs/apps/test2_sc/profile/apache.log"
-$template voot-test2_sc, "/opt/surfconext/logs/apps/test2_sc/voot/voot.log"
-$template apache-voot-test2_sc, "/opt/surfconext/logs/apps/test2_sc/voot/apache.log"
-$template galera-test2_sc, "/opt/surfconext/logs/apps/test2_sc/galera/galera.log"
-$template garb-test2_sc, "/opt/surfconext/logs/apps/test2_sc/galera/galera_garb.log"
-$template keepalived-test2_sc, "/opt/surfconext/logs/apps/test2_sc/keepalived/keepalived.log"
-$template mongo-test2_sc, "/opt/surfconext/logs/apps/test2_sc/mongo/mongo.log"
-$template apache-static-test2_sc, "/opt/surfconext/logs/apps/test2_sc/static/apache.log"
-$template apache-eb-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eb/apache.log"
-$template eblog-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eb/eb.log"
-$template apache-metadata-test2_sc, "/opt/surfconext/logs/apps/test2_sc/metadata/apache.log"
-$template ebauth-test2_sc, "/opt/surfconext/logs/log_logins/test2_sc/eb-authentication.log"
-$template oidcng-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidcng/oidcng.log"
-$template oidcngjson-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidcng/oidcngjson.log"
-$template apache-oidcng-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidcng/apache.log"
-$template oidc-playground-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidc-playground/oidc-playground.log"
-$template apache-oidcplayground-test2_sc, "/opt/surfconext/logs/apps/test2_sc/oidc-playground/oidc-playground-apache.log"
-$template myconext-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/myconext.log"
-$template myconextjson-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/myconextjson.log"
-$template apache-myconext-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/myconext-apache.log"
-$template apache-account-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/account-apache.log"
-$template apache-servicedesk-test2_sc, "/opt/surfconext/logs/apps/test2_sc/servicedeskgui/servicedesk-apache.log
-$template apache-eduid-test2_sc, "/opt/surfconext/logs/apps/test2_sc/eduid/eduid-apache.log"
-$template spdashboard-test2_sc, "/opt/surfconext/logs/apps/test2_sc/spdashboard/spdashboard.log"
-$template apache-spdashboard-test2_sc, "/opt/surfconext/logs/apps/test2_sc/spdashboard/apache.log"
-$template inviteclient-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite//inviteclient.log"
-$template invitewelcome-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite//invitewelcome.log"
-$template inviteserver-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite//inviteserver.log"
-$template invitejson-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite/invitejson.log"
-$template inviteprovisioningmock-test2_sc, "/opt/surfconext/logs/apps/test2_sc/invite//inviteprovisioningmock.log"
-$template loadbalancer-test2_sc, "/opt/surfconext/logs/apps/test2_sc/traefik/traefik.log"
$template auditd-test2_sc, "/opt/surfconext/logs/apps/test2_sc/auditd/%HOSTNAME%/auditd.log"
$template bash-test2_sc, "/opt/surfconext/logs/apps/test2_sc/bash/%HOSTNAME%/bash.log"
$template secure-test2_sc, "/opt/surfconext/logs/apps/test2_sc/secure/%HOSTNAME%/secure.log"
$template MARK-test2_sc, "/opt/surfconext/logs/monitoring/%HOSTNAME%"
+
$template hostleft-test2_sc, "/opt/surfconext/logs/hosts/test2_sc/%HOSTNAME%/%SYSLOGFACILITY-TEXT%"
# en vervang die door directe filenames:
# templates repeated here for clarity. Zaten dus eigenlijk in de file hierboven
--- before: /etc/rsyslog.d/rulesets/test2_sc.conf
+++ after: /home/bas/.ansible/tmp/ansible-local-10218660o8wswmm/tmpm_2h9anf/sc_ruleset.conf.j2
@@ -1,90 +1,103 @@
-$RuleSet test2_sc
+ruleset(name="test2_sc") {
-if $programname == "engineblock" and $msg startswith " engine" then { action(type="omfile" DynaFile="apache-eb-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "engineblock" and $msg startswith "engine" then { action(type="omfile" DynaFile="apache-eb-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "engineblock" and $msg contains '{"channel":"authentication"' then { action(type="omfile" DynaFile="ebauth-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "engineblock" { action(type="omfile" DynaFile="eblog-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "EBLOG" { action(type="omfile" DynaFile="eblog-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-EB" { action(type="omfile" DynaFile="apache-eb-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "EBAUTH" { action(type="omfile" DynaFile="ebauth-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-EBAPI" { action(type="omfile" DynaFile="apache-eb-api-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "engineblock" and $msg contains '"channel":"authentication"' then { action(type="omfile" File="/opt/surfconext/logs/log_logins/test2_sc/eb-authentication.log") stop }
+ if $programname == "engineblock" and $msg startswith 'engine' then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb/apache.log") stop }
+ if $programname == "Apache-EB" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb/apache.log") stop }
+ if $programname == "engineblock" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb/eb.log") stop }
+ if $programname == "EBLOG" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb/eb.log") stop }
+ if $programname == "Apache-EBAPI" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eb-api/apache.log") stop }
-$template haproxy-test2_sc, "/opt/surfconext/logs/apps/test2_sc/haproxy/haproxy.log"
-:programname, isequal, "haproxy" { action(type="omfile" DynaFile="haproxy-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "haproxy" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/haproxy/haproxy.log") stop }
+ if $programname == "acme.sh" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/haproxy/acme.log") stop }
-:programname, isequal, "aaserver" { action(type="omfile" DynaFile="aa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "aagui" { action(type="omfile" DynaFile="apache-aa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "aalink" { action(type="omfile" DynaFile="apache-aa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "aaserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/aa/aa.log") stop }
+ if $programname == "aagui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/aa/apache.log") stop }
+ if $programname == "aalink" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/aa/apache.log") stop }
-:programname, isequal, "dashboardgui" { action(type="omfile" DynaFile="apache-dashboard-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "dashboardserver" { action(type="omfile" DynaFile="dashboard-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "dashboardgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/dashboard/apache.log") stop }
+ if $programname == "dashboardserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/dashboard/dashboard.log") stop }
-:programname, isequal, "manageserver" { action(type="omfile" DynaFile="manage-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "managegui" { action(type="omfile" DynaFile="apache-manage-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "manageserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/manage/manage.log") stop }
+ if $programname == "managegui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/manage/apache.log") stop }
-:programname, isequal, "pdp" { action(type="omfile" DynaFile="pdp-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "pdp" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/pdp/pdp.log") stop }
-if $programname == "profile" and $msg startswith "{" then { action(type="omfile" DynaFile="profile-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "profile" { action(type="omfile" DynaFile="apache-profile-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "profile" and $msg startswith '{' then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/profile/profile.log") stop }
+ if $programname == "profile" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/profile/apache.log") stop }
-:programname, isequal, "vootserver" { action(type="omfile" DynaFile="voot-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "vootserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/voot/voot.log") stop }
-:programname, isequal, "mariadbd" { action(type="omfile" DynaFile="galera-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "mariadb" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/galera/galera.log") stop }
-:programname, isequal, "garb-systemd" { action(type="omfile" DynaFile="haproxy-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Keepalived_vrrp" { action(type="omfile" DynaFile="keepalived-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "garb-systemd" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/galera/galera_garb.log") stop }
+ if $programname == "Keepalived_vrrp" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/keepalived/keepalived.log") stop }
-:programname, startswith, "mongo" { action(type="omfile" DynaFile="mongo-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "mongod" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/mongo/mongo.log") stop }
-:programname, isequal, "Apache-STATIC" { action(type="omfile" DynaFile="apache-static-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-METADATA" { action(type="omfile" DynaFile="apache-metadata-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "Apache-STATIC" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/static/apache.log") stop }
+ if $programname == "Apache-METADATA" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/metadata/apache.log") stop }
-:programname, isequal, "oidcngserver" { action(type="omfile" DynaFile="oidcng-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "oidcngjson" { action(type="omfile" DynaFile="oidcngjson-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "oidcplaygroundserver" { action(type="omfile" DynaFile="oidc-playground-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "oidcplaygroundgui" { action(type="omfile" DynaFile="apache-oidcplayground-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "oidcngserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/oidcng/oidcng.log") stop }
+ if $programname == "oicdngjson" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/oidcng/oidcngjson.log") stop }
+ if $programname == "oidcplaygroundserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/oidc-playground/oidc-playground.log") stop }
+ if $programname == "oidcplaygroundgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/oidc-playground/oidc-playground-apache.log") stop }
-:programname, isequal, "myconextserver" { action(type="omfile" DynaFile="myconext-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "myconextjson" { action(type="omfile" DynaFile="myconextjson-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "myconextgui" { action(type="omfile" DynaFile="apache-myconext-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "accountgui" { action(type="omfile" DynaFile="apache-account-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "servicedeskgui" { action(type="omfile" DynaFile="apache-servicedesk-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "myconextserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/myconext.log") stop }
+ if $programname == "myconextjson" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/myconextjson.log") stop }
+ if $programname == "myconextgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/myconext-apache.log") stop }
+ if $programname == "accountgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/account-apache.log") stop }
+ if $programname == "servicedeskgui" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/eduid/servicedesk-apache.log") stop }
-:programname, startswith, "inviteclient" { action(type="omfile" DynaFile="inviteclient-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, startswith, "invitewelcome" { action(type="omfile" DynaFile="invitewelcome-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, startswith, "inviteserver" { action(type="omfile" DynaFile="inviteserver-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "invitejson" { action(type="omfile" DynaFile="invitejson-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, startswith, "inviteprovisioningmock" { action(type="omfile" DynaFile="inviteprovisioningmock-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "inviteclient" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/inviteclient.log") stop }
+ if $programname == "invitewelcome" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/invitewelcome.log") stop }
+ if $programname == "inviteserver" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/inviteserver.log") stop }
+ if $programname == "invitejson" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/invitejson.log") stop }
+ if $programname == "inviteprovisioningmock" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/invite/inviteprovisioningmock.log") stop }
-:programname, startswith, "loadbalancer" { action(type="omfile" DynaFile="loadbalancer-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "loadbalancer" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/traefik/traefik.log") stop }
-if $programname == "gateway" and $msg contains '{"message":"Second Factor Authenticated"' then { action(type="omfile" DynaFile="stepup-authentication-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "gateway" and $msg contains '{"message":"Intrinsic Loa Requested"' then { action(type="omfile" DynaFile="stepup-authentication-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "gateway" and $msg contains '"message":"Second Factor Authenticated"' then { action(type="omfile" File="/opt/surfconext/logs/log_logins/test2_sc/stepup-authentication.log") stop }
+ if $programname == "gateway" and $msg contains '"message":"Intrinsic Loa Requested"' then { action(type="omfile" File="/opt/surfconext/logs/log_logins/test2_sc/stepup-authentication.log") stop }
## Stepup
-$template stepup-authentication-test2_sc, "/opt/surfconext/logs/log_logins/test2_sc/stepup-authentication.log"
-:programname, isequal, "stepup-authentication" { action(type="omfile" DynaFile="stepup-authentication-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "stepup-authentication" then { action(type="omfile" File="/opt/surfconext/logs/log_logins/test2_sc/stepup-authentication.log") stop }
-$template stepup-gateway-test2_sc, "/opt/surfconext/logs/apps/test2_sc/gateway/gateway.log
-$template apache-gateway-test2_sc, "/opt/surfconext/logs/apps/test2_sc/gateway/gateway-apache.log
-:programname, isequal, "stepup-gateway" { action(type="omfile" DynaFile="stepup-gateway-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "gateway" and $msg startswith "gateway" then { action(type="omfile" DynaFile="apache-gateway-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "gateway" { action(type="omfile" DynaFile="stepup-gateway-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-gateway" { action(type="omfile" DynaFile="apache-gateway-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-selfservice" { action(type="omfile" DynaFile="stepup-selfservice-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ ## stepup# gateway
+ if $programname == "stepup-gateway" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/gateway/gateway.log") stop }
+ if $programname == "gateway" and $msg startswith "gateway" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/gateway/gateway-apache.log") stop }
+ if $programname == "gateway" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/gateway/gateway.log") stop }
+ if $programname == "Apache-gateway" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/gateway/gateway-apache.log") stop }
-$template stepup-selfservice-test2_sc, "/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice.log
-$template apache-selfservice-test2_sc, "/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice-apache.log
-if $programname == "selfservice" and $msg startswith "selfservice" then { action(type="omfile" DynaFile="apache-selfservice-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "selfservice" { action(type="omfile" DynaFile="stepup-selfservice-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-selfservice" { action(type="omfile" DynaFile="apache-selfservice-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-ra" { action(type="omfile" DynaFile="stepup-ra-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ # selfservice
+ if $programname == "stepup-selfservice" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice.log") stop }
+ if $programname == "selfservice" and $msg startswith "selfservice" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice-apache.log") stop }
+ if $programname == "selfservice" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice.log") stop }
+ if $programname == "Apache-selfservice" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/selfservice/selfservice-apache.log") stop }
-$template stepup-ra-test2_sc, "/opt/surfconext/logs/apps/test2_sc/ra/ra.log
-$template apache-ra-test2_sc, "/opt/surfconext/logs/apps/test2_sc/ra/ra-apache.log
-if $programname == "ra" and $msg startswith "ra" then { action(type="omfile" DynaFile="apache-ra-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "ra" { action(type="omfile" DynaFile="stepup-ra-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-ra" { action(type="omfile" DynaFile="apache-ra-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-middleware" { action(type="omfile" DynaFile="stepup-middleware-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ # ra
+ if $programname == "stepup-ra" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/ra/ra.log") stop }
+ if $programname == "ra" and $msg startswith "ra" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/ra/ra-apache.log") stop }
+ if $programname == "ra" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/ra/ra.log") stop }
+ if $programname == "Apache-ra" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/ra/ra-apache.log") stop }
-$template stepup-middleware-test2_sc, "/opt/surfconext/logs/apps/test2_sc/middleware/middleware.log
-$template apache-middleware-test2_sc, "/opt/surfconext/logs/apps/test2_sc/middleware/middleware-apache.log
-if $programname == "middleware" and $msg startswith "middleware" then { action(type="omfile" DynaFile="apache-middleware-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "middleware" { action(type="omfile" DynaFile="stepup-middleware-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-middleware" { action(type="omfile" DynaFile="apache-middleware-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-webauthn" { action(type="omfile" DynaFile="stepup-webauthn-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ # middleware
+ if $programname == "stepup-middleware" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/middleware/middleware.log") stop }
+ if $programname == "middleware" and $msg startswith "middleware" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/middleware/middleware-apache.log") stop }
+ if $programname == "middleware" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/middleware/middleware.log") stop }
+ if $programname == "Apache-middleware" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/middleware/middleware-apache.log") stop }
-$template stepup-webauthn-test2_sc, "/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn.log
-$template apache-webauthn-test2_sc, "/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn-apache.log
-if $programname == "webauthn" and $msg startswith "webauthn" then { action(type="omfile" DynaFile="apache-webauthn-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "webauthn" { action(type="omfile" DynaFile="stepup-webauthn-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-webauthn" { action(type="omfile" DynaFile="apache-webauthn-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-tiqr" { action(type="omfile" DynaFile="stepup-tiqr-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ # webauthn
+ if $programname == "stepup-webauthn" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn.log") stop }
+ if $programname == "webauthn" and $msg startswith "webauthn" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn-apache.log") stop }
+ if $programname == "webauthn" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn.log") stop }
+ if $programname == "Apache-webauthn" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/webauthn/webauthn-apache.log") stop }
-$template stepup-tiqr-test2_sc, "/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr.log
-$template apache-tiqr-test2_sc, "/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr-apache.log
-if $programname == "tiqr" and $msg startswith "tiqr" then { action(type="omfile" DynaFile="apache-tiqr-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "tiqr" { action(type="omfile" DynaFile="stepup-tiqr-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-tiqr" { action(type="omfile" DynaFile="apache-tiqr-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-azure-mfa" { action(type="omfile" DynaFile="stepup-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ # tiqr
+ if $programname == "stepup-tiqr" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr.log") stop }
+ if $programname == "tiqr" and $msg startswith "tiqr" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr-apache.log") stop }
+ if $programname == "tiqr" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr.log") stop }
+ if $programname == "Apache-tiqr" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/tiqr/tiqr-apache.log") stop }
-$template stepup-azure-mfa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa.log
-$template apache-azure-mfa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa-apache.log
-:programname, isequal, "azure-mfa" { action(type="omfile" DynaFile="stepup-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-azure-mfa" { action(type="omfile" DynaFile="apache-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "stepup-azuremfa" { action(type="omfile" DynaFile="stepup-azuremfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ # azure-mfa
+ if $programname == "stepup-azure-mfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa.log") stop }
+ if $programname == "azure-mfa" and $msg startswith "azure-mfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa-apache.log") stop }
+ if $programname == "azure-mfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa.log") stop }
+ if $programname == "Apache-azure-mfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azure-mfa/azure-mfa-apache.log") stop }
-$template stepup-azuremfa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa.log
-$template apache-azuremfa-test2_sc, "/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa-apache.log
-if $programname == "azure-mfa" and $msg startswith "azure-mfa" then { action(type="omfile" DynaFile="apache-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-if $programname == "azuremfa" and $msg startswith "azuremfa" then { action(type="omfile" DynaFile="apache-azuremfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "azuremfa" { action(type="omfile" DynaFile="stepup-azuremfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-azuremfa" { action(type="omfile" DynaFile="apache-azuremfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "Apache-azuremfa" { action(type="omfile" DynaFile="apache-azure-mfa-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ # azuremfa
+ if $programname == "stepup-azuremfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa.log") stop }
+ if $programname == "azuremfa" and $msg startswith "azuremfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa-apache.log") stop }
+ if $programname == "azuremfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa.log") stop }
+ if $programname == "Apache-azuremfa" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/azuremfa/azuremfa-apache.log") stop }
-if $programname == "spdashboard" and $msg startswith "spdashboard" then { action(type="omfile" DynaFile="apache-spdashboard-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "spdashboard" { action(type="omfile" DynaFile="spdashboard-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
+ if $programname == "spdashboard" and $msg startswith 'spdashboard' then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/spdashboard/spdashboard.log") stop }
+ if $programname == "spdashboard" then { action(type="omfile" File="/opt/surfconext/logs/apps/test2_sc/spdashboard/apache.log") stop }
-:programname, isequal, "audispd" { action(type="omfile" DynaFile="auditd-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "audit" { action(type="omfile" DynaFile="auditd-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "audisp-syslog" { action(type="omfile" DynaFile="auditd-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:programname, isequal, "-bash" { action(type="omfile" DynaFile="bash-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:syslogfacility-text, isequal, "authpriv" { action(type="omfile" dynafile="secure-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-:msg, contains, "-- MARK --" { action(type="omfile" DynaFile="MARK-test2_sc" dirCreateMode="0755" fileCreateMode="0640" FileGroup="surfsudo" ) stop }
-*.* ?hostleft-test2_sc
+ # per-host specials
+ if $programname == "audispd" then { action(type="omfile" DynaFile="auditd-test2_sc") stop }
+ if $programname == "audit" then { action(type="omfile" DynaFile="auditd-test2_sc") stop }
+ if $programname == "audisp-syslog" then { action(type="omfile" DynaFile="auditd-test2_sc") stop }
+ if $programname == "-bash" then { action(type="omfile" DynaFile="bash-test2_sc") stop }
+ if $programname == "authpriv" then { action(type="omfile" Dynafile="secure-test2_sc") stop }
+ if $msg contains "-- MARK --" then { action(type="omfile" DynaFile="MARK-test2_sc") stop }
+ # default action
+ action(type="omfile" dynaFile="hostleft-test2_sc")
+ stop
+} |
34c436a to
b7c987d
Compare
|
Effective diff for regular hosts: --- before: /etc/rsyslog.conf
+++ after: /home/bas/.ansible/tmp/ansible-local-1025701lkqp64do/tmp5mgco37z/rsyslog.conf.j2
@@ -1,41 +1,94 @@
+#### MODULES ####
+## input modules
+# This module provides the ability to accept syslog messages from applications running on the local system via Unix sockets
+module(load="imuxsock"
+ syssock.use="off" # Turn off message reception via local log socket; local messages are retrieved through imjournal now.
+)
+# for docker hosts, we support logging directly from inside the docker host to a TCP socket on the container host
+# Provides the ability to receive syslog messages via TCP
-module(load="imptcp")
-input(type="imptcp" port="514")
+# Provides the ability to import structured log messages from systemd journal to syslog.
-module(load="imjournal" # provides access to the systemd journal
+module(load="imjournal"
UsePid="system" # PID number is retrieved as the ID of the process the journal entry originates from
StateFile="imjournal.state"
ratelimit.interval="60"
- ratelimit.burst="20000") # Reads journald logs
+ ratelimit.burst="20000"
+)
+# Reads messages from the kernel log and submits them to the syslog engine.
-module(load="imklog") # provides kernel logging support
+module(load="imklog")
+# This module provides the ability to inject periodic “mark” messages to the input of rsyslog.
-module(load="immark" interval="300" ) # provides --MARK-- message capability
+module(load="immark"
+ interval="300"
+ writeallmarkmessages="on"
+)
+## output modules
+# This module supports sending syslog messages over the reliable RELP protocol
module(load="omrelp")
+# The omfile plug-in provides the core functionality of writing messages to files residing inside the local file system
+module(load="builtin:omfile"
+ template="RSYSLOG_TraditionalFileFormat" # Use default timestamp format
+ dirCreateMode="0755" DirOwner="root" DirGroup="root" fileCreateMode="0640" FileOwner="root" FileGroup="adm"
+ # Set default file permission
+)
+#### GLOBAL DIRECTIVES ####
-# Where to place auxiliary files
-global(workDirectory="/var/spool/rsyslog")
+# where to place aux file (spool, etc)
+global(workDirectory="/var/lib/rsyslog")
+# Support large messages
-$MaxMessageSize 32k
+global(maxMessageSize="32k")
+# Keep fully qualified hostnames instead of stripping the local domain.
-$PreserveFQDN on
+global(preserveFQDN="on")
+#### LOCAL TEMPLATES AND RULES ####
+## templates
-template(name="CustomRelpFormat" type="string"
- string="<%PRI%>%TIMESTAMP% docker1.test2.ams.surfconext.nl %syslogtag%%msg%\n")
+template(name="CustomRelpFormat"
+ type="string"
+ string="<%PRI%>%TIMESTAMP% docker1.test2.ams.surfconext.nl %syslogtag%%msg%\n"
+)
+## rules
+## this is the default ruleset, used for local messages
+# emergency messages to the console
-*.emerg :omusrmsg:*
+if prifilt("*.emerg") then {
+ action(type="omusrmsg" users="*")
+}
-# Logs are forwarded to syslog_log1_test2
+# all other local logs are forwarded to syslog_log1_test2
action(type="omrelp"
-target="syslog.test2.surfconext.nl"
-port="5140"
-tls="on"
-tls.caCert="/etc/pki/rsyslog/rsyslogclientca.crt"
-tls.MyCert="/etc/pki/rsyslog/rsyslogclient.crt"
-tls.MyPrivKey="/etc/pki/rsyslog/rsyslogclient.key"
-tls.authmode="name"
-tls.permittedpeer=["syslog.test2.surfconext.nl"]
-queue.type="LinkedList"
-queue.filename="syslog_log1_test2"
-queue.spoolDirectory="/var/spool/rsyslog"
-queue.maxdiskspace="1G"
-queue.saveonshutdown="on"
-action.resumeRetryCount="-1"
-action.resumeInterval="5"
-action.writeAllMarkMessages="on"
-template="CustomRelpFormat")
+ target="syslog.test2.surfconext.nl"
+ port="5140"
+ tls="on"
+ tls.caCert="/etc/pki/rsyslog/rsyslog_ca.pem"
+ tls.MyCert="/etc/pki/rsyslog/rsyslogclient.crt"
+ tls.MyPrivKey="/etc/pki/rsyslog/rsyslogclient.key"
+ tls.authmode="name"
+ tls.permittedpeer=["syslog.test2.surfconext.nl"]
+ queue.type="LinkedList"
+ queue.filename="syslog_log1_test2"
+ queue.spoolDirectory="/var/spool/rsyslog"
+ queue.maxdiskspace="1G"
+ queue.saveonshutdown="on"
+ action.resumeRetryCount="-1"
+ action.resumeInterval="5"
+ action.writeAllMarkMessages="on"
+ template="CustomRelpFormat"
+)
+# stop processing local messages
+stop
|
|
Ik twijfel nog over deze: +## input modules
+# This module provides the ability to accept syslog messages from applications running on the local system via Unix sockets
+module(load="imuxsock"
+ syssock.use="off" # Turn off message reception via local log socket; local messages are retrieved through imjournal now.
+)volgens de docs is die niet meer nodig op systemd-enabled servers. Zie
Echter, op de central logserver staat deze momenteel wel aan (specifiek met de |
gewoon even uitproberen op test2? |
|
De logservers hebben idd een |
rsyslog_ca.pem and rsyslogclientca.crt where the same file. Now just use a single source file and put it in a single location.
c02cb09 to
b183554
Compare
…rsyslog versions
No description provided.