# Remote audit / syslog collector for the diskless fleet (LAB).
#
# Receives logs forwarded by booted diskless hosts over plain TCP/514 and writes
# them per-source-host. Diskless hosts have an immutable, RAM-only overlay root,
# so their local audit log dies on reboot — this gives auditd somewhere durable
# to offload to (STIG remote-audit-offload, deviation #6 in docs/stig-deviations.md).
#
# Lab posture: PLAINTEXT TCP, mirroring the HTTP-boot/no-TLS lab stack. For
# production switch to TLS (gtls driver) or RELP+TLS and restrict senders by
# subnet — see README.md.

global(workDirectory="/var/spool/rsyslog")

# --- intake: plain TCP syslog ---
module(load="imtcp" maxSessions="1000")
input(type="imtcp" port="514")
# Some senders only speak UDP; uncomment to also accept it (lossy, no queue).
#module(load="imudp")
#input(type="imudp" port="514")

# Disk-assisted main queue so a brief disk stall or a burst of records doesn't
# drop audit events (the records keep flowing to spool, then drain to disk).
main_queue(
    queue.type="LinkedList"
    queue.filename="mainq"
    queue.maxdiskspace="1g"
    queue.saveOnShutdown="on"
)

# --- relay a COPY of audit records to the Wazuh SIEM (separate node) -----------
# Forwards audit/local6 records to the Wazuh manager's syslog listener on the
# dedicated SIEM node (wazuh1.bitasylum.org) for parsing/correlation/alerting,
# WHILE still writing the durable per-host files below (no `stop`, so records
# continue to the file actions). Own disk-assisted queue -> a Wazuh outage never
# blocks the file writes or drops records (resumeRetryCount=-1 spools + drains on
# reconnect). The serving host must resolve + route to the SIEM node. After
# editing, rebuild: `docker compose build audit && docker compose up -d audit`.
#
# ⚠ PLAINTEXT 514 — only acceptable if serving-host → SIEM-node is a TRUSTED
# private path. Audit records are sensitive; if this hop crosses any routed/
# untrusted network, switch to syslog-over-TLS (gtls, port 6514, fleet CA) BEFORE
# relying on it (ISM: protect logs in transit). See serving/siem/README.md.
if ($programname == 'audispd')
   or ($programname startswith 'audit')
   or ($syslogfacility-text == 'local6') then {
    action(type="omfwd" target="wazuh1.bitasylum.org" port="514" protocol="tcp"
           action.resumeRetryCount="-1"
           queue.type="LinkedList" queue.filename="wazuhfwdq"
           queue.maxDiskSpace="256m" queue.saveOnShutdown="on")
}

# --- per-source-host files (keyed by SENDER IP, not the claimed hostname) ---
template(name="HostAudit"    type="string" string="/var/log/remote/%FROMHOST-IP%/audit.log")
template(name="HostMessages" type="string" string="/var/log/remote/%FROMHOST-IP%/messages.log")

# Audit records (audisp-syslog tags them 'audispd'/'audit', or forwards on the
# local6 facility) go to a dedicated per-host audit.log; everything else to
# messages.log. Files/dirs are created 0640/0750 (audit logs aren't world-read).
if ($programname == 'audispd')
   or ($programname startswith 'audit')
   or ($syslogfacility-text == 'local6') then {
    action(type="omfile" dynaFile="HostAudit"
           dirCreateMode="0750" fileCreateMode="0640")
    stop
}

action(type="omfile" dynaFile="HostMessages"
       dirCreateMode="0750" fileCreateMode="0640")