Forge Home

simp_rsyslog

A SIMP Puppet Profile for standard Rsyslog configurations

11,532 downloads

193 latest version

4.7 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 0.9.0 (latest)
  • 0.7.0
  • 0.6.0
  • 0.5.2
  • 0.5.1
  • 0.4.0
  • 0.3.0
  • 0.2.0
  • 0.1.2
  • 0.1.1 (deleted)
  • 0.1.0
  • 0.0.3
released Oct 12th 2023
This version is compatible with:
  • Puppet Enterprise 2023.5.x, 2023.4.x, 2023.3.x, 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x
  • Puppet >= 7.0.0 < 9.0.0
  • , , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'simp-simp_rsyslog', '0.9.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add simp-simp_rsyslog
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install simp-simp_rsyslog --version 0.9.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download
Tags: rsyslog, simp

Documentation

simp/simp_rsyslog — version 0.9.0 Oct 12th 2023

#pupmod-simp-simp_rsyslog

License CII Best Practices Puppet Forge Puppet Forge Downloads Build Status

Table of Contents

Description

This module is a SIMP Puppet profile for setting up common Rsyslog configurations as supported by the SIMP ecosystem

This is a SIMP module

This module is a component of the System Integrity Management Platform, a compliance-management framework built on Puppet.

If you find any issues, they may be submitted to our bug tracker.

This module is optimally designed for use within a larger SIMP ecosystem, but it can be used independently:

  • When included within the SIMP ecosystem, security compliance settings will be managed from the Puppet server.
  • If used independently, all SIMP-managed security subsystems are disabled by default and must be explicitly opted into by administrators. Please review the parameters in simp/simp_options for details.

Setup

What simp_rsyslog affects

This module provides configurations for both Rsyslog local and Rsyslog server configurations.

Usage

Local Logging

To set up local logging, you can simply do the following:

include simp_rsyslog

The $log_collection Hash provides an Rsyslog 7 compatible set of filters that you wish to collect. These will be considered security relevant and fed into /var/log/secure by default.

The Hash has the following format and all entries will be combined with a logical OR.

$log_collection = {
  'programs'   => [ <logged daemon names> ],
  'facilities' => [ <syslog facilities> ],
  'priorities' => [ <syslog priorities> ],
  'msg_starts' => [ <strings the message starts with> ],
  'msg_regex'  => [ <regular expression matches> ]
}

If you need something more complex than this, you will need to configure your own rsyslog rules using the rsyslog::rule defined type.

If you simply want to log EVERYTHING to your remote servers, set simp_rsyslog::collect_everything to true.

If you do this, it is highly recommended that you set simp_rsyslog::log_local to false so that you don't overwhelm your filesystem.


NOTE

If you do not capture the local6 syslog facility, you will lose a lot of SIMP-specific messaging


Centralized Logging

If you wish to collect logs from remote hosts, you can do the following:

Manifest:

include simp_rsyslog

Hieradata:

---
simp_rsyslog::is_server : true

# If your system uses simp/iptables then you should also set the following
iptables::precise_match: true

This will set your system up as an Rsyslog server, using TLS which is capable of collecting both TCP and UDP logs.

At this time, the version of Rsyslog that ships with EL systems cannot handle both TLS and non-TLS TCP connections at the same time. When it can, we will support this mode of log collection.

UDP logs will not be encrypted in transit but are supported for network device compatibility.

Log Forwarding

If you wish to set your system up to forward logs to a set of remote log servers, in either the server or client case, you should use the following in Hiera:

simp_rsyslog::forward_logs: true

This will use the $simp_options::syslog::log_servers and $simp_options::syslog::failover_log_servers variables to set the targets for your logs. Alternatively, you can specify the targets in Hiera directly.

TLS and TCP connections will be used for log forwarding for security purposes.


WARNING

Be VERY careful when setting your simp_rsyslog::log_servers and simp_rsyslog::failover_log_servers Arrays!

There is no foolproof way to detect if you are setting your local log server as part of the Array. If you do this, you may end up with infinite log loops that fill your log server's disk space within minutes.

WARNING


Reference

The module reference can be found in the REFERENCE.md file.

Limitations

This is a SIMP Profile. It will not expose all options of the underlying modules, only the ones that are conducive to a supported SIMP infrastructure.

If you need to do things that this module does not cover, you may need to create your own profile or inherit this profile and extend it to meet your needs.

SIMP Puppet modules are generally intended for use on Red Hat Enterprise Linux and compatible distributions, such as CentOS. Please see the metadata.json file for the most up-to-date list of supported operating systems, Puppet versions, and module dependencies.

Development

Please read our Contribution Guide.

If you find any issues, they can be submitted to our JIRA.

Acceptance tests

This module includes Beaker acceptance tests using the SIMP Beaker Helpers. By default the tests use Vagrant with VirtualBox as a back-end; Vagrant and VirtualBox must both be installed to run these tests without modification. To execute the tests run the following:

bundle install
bundle exec rake beaker:suites

Please refer to the SIMP Beaker Helpers documentation for more information.