Back to Details

implementing-syslog-centralization-with-rsyslog

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Implementing Syslog Centralization with Rsyslog

使用Rsyslog实现Syslog集中化

When to Use

适用场景

  • When deploying or configuring implementing syslog centralization with rsyslog capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation
  • 在您的环境中部署或配置基于rsyslog的syslog集中化功能时
  • 建立符合合规要求的安全控制措施时
  • 构建或改进该领域的安全架构时
  • 开展需要此实现的安全评估时

Prerequisites

前提条件

  • Familiarity with security operations concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities
  • 熟悉安全运维概念与工具
  • 可访问测试或实验室环境以安全执行操作
  • 安装了Python 3.8+及所需依赖
  • 拥有任何测试活动的适当授权

Instructions

操作步骤

  1. Install dependencies: 
    pip install jinja2 paramiko
  2. Generate TLS certificates for rsyslog server and clients using OpenSSL.
  3. Run the agent to generate rsyslog server and client configurations:
    • Server: TLS listener on port 6514, per-host directory output, JSON-format templates
    • Client: TLS forwarding with disk-assisted queues for reliability
  4. Deploy configurations to servers via SSH (paramiko).
  5. Validate TLS connectivity and log delivery.
bash
python scripts/agent.py --server-ip 10.0.0.1 --clients 10.0.0.10,10.0.0.11 --ca-cert ca.pem --output syslog_report.json
  1. 安装依赖：
    pip install jinja2 paramiko
  2. 使用OpenSSL为rsyslog服务器和客户端生成TLS证书。
  3. 运行agent生成rsyslog服务器和客户端配置：
    • 服务器：6514端口的TLS监听器，按主机目录输出，JSON格式模板
    • 客户端：带磁盘辅助队列的TLS转发以确保可靠性
  4. 通过SSH（paramiko）将配置部署到服务器。
  5. 验证TLS连接和日志交付。
bash
python scripts/agent.py --server-ip 10.0.0.1 --clients 10.0.0.10,10.0.0.11 --ca-cert ca.pem --output syslog_report.json

Examples

示例

Server Configuration (TLS)

服务器配置（TLS）

module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1"
       StreamDriver.Authmode="x509/name")
input(type="imtcp" port="6514")
template(name="PerHostLog" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?PerHostLog
module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1"
       StreamDriver.Authmode="x509/name")
input(type="imtcp" port="6514")
template(name="PerHostLog" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?PerHostLog

Client Configuration (Reliable Forwarding)

客户端配置（可靠转发）

action(type="omfwd" target="10.0.0.1" port="6514" protocol="tcp"
       StreamDriver="gtls" StreamDriverMode="1"
       StreamDriverAuthMode="x509/name"
       queue.type="LinkedList" queue.filename="fwdRule1"
       queue.maxdiskspace="1g" queue.saveonshutdown="on"
       action.resumeRetryCount="-1")
action(type="omfwd" target="10.0.0.1" port="6514" protocol="tcp"
       StreamDriver="gtls" StreamDriverMode="1"
       StreamDriverAuthMode="x509/name"
       queue.type="LinkedList" queue.filename="fwdRule1"
       queue.maxdiskspace="1g" queue.saveonshutdown="on"
       action.resumeRetryCount="-1")