1

I'm trying to set up an rsyslog client (running rsyslog 7.4.8) that will log to two remote servers via two different SSL configurations. To do this it looks like I need to migrate from the legacy configuration file format to the new action-based format.

If I have the following for /etc/rsyslog.conf then everything works fine. The remote server receives the messages, and netstat shows an established TCP connection from the client to the remote server:

$ModLoad imuxsock.so
$ModLoad imklog.so

$DefaultNetstreamDriver gtls
$ActionSendStreamDriverAuthMode anon
$ActionSendStreamDriverMode 1

$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.pem
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/local-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/local-key.pem

*.* @@10.50.59.241:6514

From what I'm able to glean from the rsyslog documentation I should be able to do something along these lines:

$ModLoad imuxsock.so
$ModLoad imklog.so

$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.pem
$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/local-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/local-key.pem

*.* action (type="omfwd" protocol="tcp" Target="10.50.59.241" Port="6514" StreamDriverMode="1" StreamDriver="gtls" StreamDriverAuthMode="anon")

But this second configuration doesn't work. rsyslogd restarts successfully so I know there's no syntax error with this configuration. But netstat never shows a connection even being attempted to the remote syslog server. What am I missing?

1 Answer 1

1

Well after a bunch of head-banging I figured this out on my own. First off, there's a bug in some versions of rsyslog that will prevent this from working (you'll never see a connection established to one or more of the target servers) so make sure you're using version 7.6 or later of rsyslog.

Make sure your CA file has any CA's needed for all targets listed in it. Order isn't important. Then your conf file should look something like this:

$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/ca.pem

*.* action(type="omfwd" protocol="tcp" Target="10.50.59.241" Port="6514" StreamDriverMode="1" StreamDriver="gtls" StreamDriverAuthMode="anon")

*.* action(type="omfwd" Protocol="tcp" Target="some.other.host.com" Port="6514" StreamDriverMode="1" StreamDriver="gtls" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.some.other.host.com")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .