0

I have an rsyslog server at front and need to forward certain facilities to a remote server. I created a template for transport as HTTP body:

template(name="syslogforward" type="list") {
    constant(value="POST / HTTP/1.0\n")
    constant(value="Content-type: text/plain; charset=UTF-8\n")
    constant(value="\n")
    property(name="timereported")
    constant(value=" ")
    property(name="hostname")
    constant(value=" ")
    property(name="app-name")
    constant(value=": ")
    property(name="pri-text")
    property(name="msg")
}

local1.* action(
    Name="Forward_to_remote"
    type="omfwd"
    Template="syslogforward"
    Target="xxx.xxx.xxx.xxx"
    Port="8080"
    Protocol="tcp"
)

I'd like to forward these messages encrypted with HTTPS, do I have to launch another process opening a local socket and doing the HTTPS or is there another way built in?

3
  • I don't understand "upstream site", upstream regarding what? The syslog traffic towards my server is encrypted as shown in the rsyslog docs. I think I cannot use action type omfwd as syslog is plain text. I believe I need to setup a listener doing the encrypted forwarding (e.g. curl) and have rsyslog piping to it.
    – Marc0
    Commented Feb 14, 2019 at 19:47
  • After checking the omhttp description I'll check this module.
    – Marc0
    Commented Feb 17, 2019 at 11:19
  • Module omhttp is too new. It's not included in Debians rsyslog version v8.24.0.
    – Marc0
    Commented Feb 17, 2019 at 11:30

1 Answer 1

0

I solved my problem by writing a perl script opening a PIPE on the input end pumping the newline-terminated messages to the remote site using LWP::UserAgent giving me any freedom regarding TLS issues (use CA cert or not, verify host or not). And instead of omfwd I use ompipe.

My rsyslog config changed like this:

template(name="syslogforward" type="list") {
    property(name="timereported")
    constant(value=" ")
    property(name="hostname")
    constant(value=" ")
    property(name="app-name")
    constant(value=": ")
    property(name="pri-text")
    property(name="msg")
    # avoid buffering
    # maybe I should re-think this
    constant(value="\n")
}

local1.* action(
    Name="Forward_to_remote"
    Type="ompipe"
    # just a demo pipe
    Pipe="/tmp/mypipe"
    Template="syslogforward"
)

Next I'll go and change my puppet module...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .