5

I am a newbie to Linux and rsyslog. I have used the logfiles for many years, but I have never had to set one up. At this point I have some Proof of Concept devices pointing to my Debain Linux server. I have the syslog messages coming in and being written to a single file: /var/log/prd/fwlog I am only concerned about 3 device types - switches, routers and firewalls. (all cisco) My rsyslog.conf is fairly simple, I have only modified the basic config, commented out the stuff I didn't like/need?

snipped out the comment out stuff.

$ModLoad immark  # provides --MARK-- message capability    

$ModLoad imudp
$UDPServerRun 514

$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

*.*          /var/log/prd/fwlog

Finally my questions!

  1. I want to rotate and separate the routers and switches in a log with a date stamp called 'rslog-YYYY-MM-DD' also the firewalls into a log with a date stamp called 'fwlog-YYYY-MM-DD'

  2. I want to compress(gzip?) the logs after 48hrs.

what do I need to add to my config?

I think I added the directory and file to my rsyslog in /etc/logrotate.d/rsyslog

/var/log/syslog
{
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

/var/log/prd/fwlog*
/var/log/prd/rslog*

{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

Thanks in advance for any help!

5

I want to rotate and separate the routers and switches in a log with a date stamp called 'rslog-YYYY-MM-DD' also the firewalls into a log with a date stamp called 'fwlog-YYYY-MM-DD'

To start, you need to separate your firewall and switches with filtering in rsyslog. Exactly how to do this varies based on the version of rsyslog you are running. They have changed configuration syntax quite a bit over time. My notes below are based on an older release of Rsyslog v3 that ships with Red Hat. You will want to verify this against the documentation for your release.

For a property based filter, it will look something like;

:fromhost-ip,isequal,"192.168.1.1"              /var/log/prd/fwlog
&~
:fromhost-ip,isequal,"192.168.1.254"            /var/log/prd/rslog
&~

The next part is your desired filename. For that, you will combine filtering with rsyslog's templates to generate dynamic filenames for your logs.

$template Firewall,"/var/log/prd/fwlog-%$YEAR%-%$MONTH%-%$DAY%"
$template Switch,"/var/log/prd/rslog-%$YEAR%-%$MONTH%-%$DAY%"

:fromhost-ip,isequal,"192.168.1.1"              -?Firewall
&~
:fromhost-ip,isequal,"192.168.1.254"            -?Switch
&~

I want to compress(gzip?) the logs after 48hrs.

The last part, compression, would rely on a daily cron job that compresses files. (Where $date is $today - 2.) The date command already has a built in format for YYYY-MM-DD, so we'll use that. (%F)

gzip /var/log/prd/*-$(date --date='2 days ago' +%F)
  • with the facility modifications would I just add the template above where the rules are? – Security_Pete Dec 30 '14 at 20:14
  • 1
    Yes, and apply the template to your facility filter. local4.* -?Firewall – Aaron Copley Dec 30 '14 at 20:19
  • 1
    No. Your cronjob is to gzip your logs. This runs daily at 0100. Make sure gzip and date is in /bin on your system. 0 1 * * * /bin/gzip /var/log/prd/*-$(/bin/date --date='2 days ago' +%F) – Aaron Copley Dec 30 '14 at 20:44
  • 1
    While specifying the IP address in the config may work, consider whether this is a long term good idea. As in, what about when you add a new switch? – dmourati Dec 30 '14 at 20:49
  • 1
    Append is fine. – Aaron Copley Dec 30 '14 at 21:00
2

First you should understand a bit more about syslog facility and severity. Those represent the two values you've added as *.* in your conf.

http://wiki.gentoo.org/wiki/Rsyslog#Facility

http://wiki.gentoo.org/wiki/Rsyslog#Severity

If you can set your sending daemons to use a different facility and/or severity for the routers/switches from the firewall, you should be able to easily create filter rules on your central log server to separate the logs out into different files as you've specified. For example, send routers/switches as local1 and firewall as local2.

Other than those settings, you could also separate out switch logs from firewall logs by filtering on the source IP address. The rsyslog property is called fromhost-ip.

Once you have the inbound rsyslog setup, you'll need to fine tune your logrotate settings. I think both file paths should be on one single line for starters. To compress after two days worth of logs will require some additional effort. See:

https://stackoverflow.com/questions/4495476/logrotate-compression-files-modified-x-number-of-days

You can test with logrotate -f /etc/logrotate.conf /etc/logrotate.d/rsyslog

For more details see:

http://articles.slicehost.com/2010/6/30/understanding-logrotate-on-debian-part-1

  • 1
    Additional comment re: date strings in filenames for rsyslog. You probably want templates: rsyslog.com/doc/master/configuration/templates.html – dmourati Dec 30 '14 at 19:32
  • I do not see the facility in the messages I am receiving on linux. I have a kiwi syslog set up and it does show the facility. My routers are set to local4, and firewalls are local7. When I did not get the messages i simply set it to . – Security_Pete Dec 30 '14 at 19:36
  • 1
    Your rsyslog server sees the facility and can act on it. Something like local4.* /var/log/prd/rslog local7.* /var/log/prd/fwlog – dmourati Dec 30 '14 at 19:38
  • 1
    Good idea for using one facility for switches and one for routers, etc. – Aaron Copley Dec 30 '14 at 19:50
  • here is what I added, but I dont see anything going to my rslog... local7.* /var/log/prd/fwlog local4.* /var/log/prd/rslog – Security_Pete Dec 30 '14 at 20:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.