47 lines
1.9 KiB
Plaintext
47 lines
1.9 KiB
Plaintext
# Remote audit / syslog collector for the diskless fleet (LAB).
|
|
#
|
|
# Receives logs forwarded by booted diskless hosts over plain TCP/514 and writes
|
|
# them per-source-host. Diskless hosts have an immutable, RAM-only overlay root,
|
|
# so their local audit log dies on reboot — this gives auditd somewhere durable
|
|
# to offload to (STIG remote-audit-offload, deviation #6 in docs/stig-deviations.md).
|
|
#
|
|
# Lab posture: PLAINTEXT TCP, mirroring the HTTP-boot/no-TLS lab stack. For
|
|
# production switch to TLS (gtls driver) or RELP+TLS and restrict senders by
|
|
# subnet — see README.md.
|
|
|
|
global(workDirectory="/var/spool/rsyslog")
|
|
|
|
# --- intake: plain TCP syslog ---
|
|
module(load="imtcp" maxSessions="1000")
|
|
input(type="imtcp" port="514")
|
|
# Some senders only speak UDP; uncomment to also accept it (lossy, no queue).
|
|
#module(load="imudp")
|
|
#input(type="imudp" port="514")
|
|
|
|
# Disk-assisted main queue so a brief disk stall or a burst of records doesn't
|
|
# drop audit events (the records keep flowing to spool, then drain to disk).
|
|
main_queue(
|
|
queue.type="LinkedList"
|
|
queue.filename="mainq"
|
|
queue.maxdiskspace="1g"
|
|
queue.saveOnShutdown="on"
|
|
)
|
|
|
|
# --- per-source-host files (keyed by SENDER IP, not the claimed hostname) ---
|
|
template(name="HostAudit" type="string" string="/var/log/remote/%FROMHOST-IP%/audit.log")
|
|
template(name="HostMessages" type="string" string="/var/log/remote/%FROMHOST-IP%/messages.log")
|
|
|
|
# Audit records (audisp-syslog tags them 'audispd'/'audit', or forwards on the
|
|
# local6 facility) go to a dedicated per-host audit.log; everything else to
|
|
# messages.log. Files/dirs are created 0640/0750 (audit logs aren't world-read).
|
|
if ($programname == 'audispd')
|
|
or ($programname startswith 'audit')
|
|
or ($syslogfacility-text == 'local6') then {
|
|
action(type="omfile" dynaFile="HostAudit"
|
|
dirCreateMode="0750" fileCreateMode="0640")
|
|
stop
|
|
}
|
|
|
|
action(type="omfile" dynaFile="HostMessages"
|
|
dirCreateMode="0750" fileCreateMode="0640")
|