0

I've set up Rsyslog with TLS on two Debian machines and configured remote logging (log-server, log-shipper). However, I am getting "garbled" Text in the logs on the server:

Oct 22 07:58:45 log-shipper.example.org #000��}̪��#0009#000k#000�#000�#000��|��#0003#000g#000E#000�#000#026#001#000#000J#000#027#000#000#000#026#000#000#000#005#000#005#001#000#000#000#000�#001#000#001#000#000##000#000
Oct 22 07:58:45 log-shipper.example.org #000#014
Oct 22 07:58:46 log-shipper.example.org #026#003#001#000�#001#000#000�#003#003[̓#006�: �Q#035�'Q#035�o#014�#001V<��[��|ng�[ܴ#000#000r�,��̩���

Basically I followed the Rsyslog docs here, and also followed other tutorials on the Internet, but the result is always the same.

After having spent 2 days on this, I'm out of ideas. Anyone has a hint, or experienced it too?

Server config:

$ModLoad imtcp # TCP listener

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /etc/ssl/certs/ca-cert.pem
$DefaultNetstreamDriverCertFile /etc/ssl/certs/server-cert.pem
$DefaultNetstreamDriverKeyFile /etc/ssl/certs/server-key.pem

$InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode
$InputTCPServerStreamDriverAuthMode anon
$InputTCPServerRun 5822 # start up listener at port 5822

Client config:

# make gtls driver the default
$DefaultNetstreamDriver gtls

# certificate files
$DefaultNetstreamDriverCAFile /var/tmp/ca.pem
$DefaultNetstreamDriverCertFile /var/tmp/storage1-cert.pem
$DefaultNetstreamDriverKeyFile /var/tmp/storage1-key.pem

$ActionSendStreamDriverAuthMode anon
$ActionSendStreamDriverMode 1 # run driver in TLS-only mode
*.* @@(o)log-server.example.org:5822 # forward everything to remote server
0

This usually means there's something wrong with encryption, check what syslog says when rsyslog service is starting, if it's complaining about anything. Other than that, how did you setup Certificate Authority, as that's the trickiest part of whole setup? Also, is your $DefaultNetstreamDriverCAFile same on both server?

0

Normally, I would comment but not enough rep in this community. I have seen garbled text like that before when I was doing an NMAP scan of a server and watching the results in Syslog. Someone has posted a longer snippet of the attack:

https://superuser.com/questions/1091351/rsyslogd-log-entry-about-attack-created-by-unknown-application

Please take a look and see if the logs reflect that attack.

I have also noticed while setting up logging to an Rsyslog server the inclusion of the #014 character (ie when I set up conversion from Windows EventLog events to Rsyslog server) but without the garbled text. When I switched to another Syslog format (ie getting logs in BSD Syslog format) I was no longer getting the #014 character. You may want to consider looking into another log collection software like NXLog for this to collect and centralize log collection.

0

For Ubuntu 18.04 I used the following syntax:

$DefaultNetstreamDriverCAFile /etc/ssl/certs/ca-cert.pem 
$DefaultNetstreamDriverCertFile /etc/ssl/certs/server-cert.pem
$DefaultNetstreamDriverKeyFile /etc/ssl/certs/server-key.pem

# provides TCP syslog reception with encryption (TLS)
module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1" StreamDriver.AuthMode="anon")
input(type="imtcp" port="6514" )

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.