implementing-syslog-centralization-with-rsyslog

Original：🇺🇸 English

Translated

1 scriptsChecked / no sensitive code detected

Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation, generating server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings. Use when building a centralized, encrypted syslog pipeline, hardening rsyslog client/server configs for high-availability log infrastructure, or troubleshooting TLS-based syslog forwarding.

2installs

Sourcemukul975/anthropic-cybersecurity-skills

Added on2026-08-26

NPX Install

npx skill4agent add mukul975/anthropic-cybersecurity-skills implementing-syslog-centralization-with-rsyslog

SKILL.md Content

View Translation Comparison →

Implementing Syslog Centralization with Rsyslog

When to Use

When deploying or configuring implementing syslog centralization with rsyslog capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies:
```
pip install jinja2 paramiko
```
Generate TLS certificates for rsyslog server and clients using OpenSSL.
Run the agent to generate rsyslog server and client configurations:
- Server: TLS listener on port 6514, per-host directory output, JSON-format templates
- Client: TLS forwarding with disk-assisted queues for reliability
Deploy configurations to servers via SSH (paramiko).
Validate TLS connectivity and log delivery.

bash

python scripts/agent.py --server-ip 10.0.0.1 --clients 10.0.0.10,10.0.0.11 --ca-cert ca.pem --output syslog_report.json

Examples

Server Configuration (TLS)

module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1"
       StreamDriver.Authmode="x509/name")
input(type="imtcp" port="6514")
template(name="PerHostLog" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?PerHostLog

Client Configuration (Reliable Forwarding)

action(type="omfwd" target="10.0.0.1" port="6514" protocol="tcp"
       StreamDriver="gtls" StreamDriverMode="1"
       StreamDriverAuthMode="x509/name"
       queue.type="LinkedList" queue.filename="fwdRule1"
       queue.maxdiskspace="1g" queue.saveonshutdown="on"
       action.resumeRetryCount="-1")