Syslog-ng

How to Setup Rsyslog Client to Send Logs to Rsyslog Server in CentOS 7

Syslog-ng (Old)

Installation

CentOS

dnf install -y epel-release
dnf install -y syslog-ng
systemctl enable syslog-ng
systemctl start syslog-ng

Debian

apt install syslog-ng

If you face dependencies issues:

wget -qO - https://ose-repo.syslog-ng.com/apt/syslog-ng-ose-pub.asc | sudo apt-key add -
echo "deb https://ose-repo.syslog-ng.com/apt/ nightly ubuntu-jammy" | sudo tee -a /etc/apt/sources.list.d/syslog-ng-ose.list
apt update
apt install syslog-ng

Script

nano script.sh

#!/bin/bash
# backup .conf files:
cp -f /etc/sysctl.conf{,.bak}
# adding parameters
sh -c 'echo "fs.file-max = 65535" >> /etc/sysctl.conf'
sh -c 'echo "net.core.somaxconn = 65535" >> /etc/sysctl.conf'
sh -c 'echo "net.core.rmem_default = 33554432" >> /etc/sysctl.conf'
sh -c 'echo "net.core.rmem_max = 33554432" >> /etc/sysctl.conf'
sh -c 'echo "net.core.netdev_max_backlog = 10000" >> /etc/sysctl.conf'

chmod +x script.sh

./script.sh

Configuration

CentOS

cp /etc/syslog-ng/syslog-ng.conf /etc/syslog-ng/syslog-ng.conf.backup
nano /etc/syslog-ng/syslog-ng.conf

Debian

cp /etc/syslog-ng.conf /etc/syslog-ng.conf.bkp
nano /etc/syslog-ng.conf

Config File

- Note: don't forget changing the version number on the conf file from backup file and restart the service

Restart Syslog-ng

systemctl restart syslog-ng

Log Rotation

crontab -e
0 5 * * * find /var/log/syslog-ng/networks/ -type f -name \*.log -mtime +7 -exec rm {} \;
0 5 * * * find /var/log/syslog-ng/security/ -type f -name \*.log -mtime +7 -exec rm {} \;
0 5 * * * find /var/log/syslog-ng/default/ -type f -name \*.log -mtime +7 -exec rm {} \;

Splunk Connect for Syslog (SC4S)

Blog

Index Configuration (Indexer Server)

SC4S is pre-configured to map each sourcetype to a typical index. For new installations, it is best practice to create them in Splunk when using the SC4S defaults. SC4S can be easily customized to use different indexes if desired.

  • email

  • epav

  • epintel

  • fireeye

  • gitops

  • infraops

  • netauth

  • netdlp

  • netdns

  • netfw

  • netids

  • netlb

  • netops

  • netwaf

  • netproxy

  • netipam

  • oswin

  • oswinsec

  • osnix

  • print

  • _metrics (Optional opt-in for SC4S operational metrics; ensure this is created as a metrics index)

Configure Splunk HTTP Event Collector (Indexer Server)

  • Create a New Token:

    • Name: SC4S

    • Options: Default settings

Install and Configure SC4S (Syslog Server)

Set the host OS kernel to match the default receiver buffer of SC4S, which is set to 16MB.

a. Add the following to /etc/sysctl.conf:

b. Apply to the kernel:

Ensure the kernel is not dropping packets:

Create the systemd unit file

SC4S Setup

Modify the following values prior to running the script:

  • HEC_URL

  • HEC_TOKEN

Configure Additional PKI Trust Anchors (Syslog Server)

Additional trusted (private) Certificate Authorities can be added by following these steps:

  • Location: Append each PEM formatted certificate to the file /opt/sc4s/tls/trusted.pem.

Example:

Check podman/docker logs for errors

Search on Splunk for successful installation of SC4S

Send sample data to default udp port 514 of SC4S host

SC4S Dashboard
Block parser to drop events

nano /opt/sc4s/local/config/app_parsers/vmware_vsphere_block_sourcetype-postfilter.conf Link

nano /opt/sc4s/local/config/app_parsers/vmware_vsphere_sps-postfilter.conf Link

PreviousSplunk DeploymentNextUniversal Forwarder

Last updated