Ryfujk

Trouble understanding overseas colleagues

What would happen if the UK refused to take part in EU Parliamentary elections?

Why "be dealt cards" rather than "be dealing cards"?

HashMap containsKey() returns false although hashCode() and equals() are true

Opposite of a diet

Will it be accepted, if there is no ''Main Character" stereotype?

I'm in charge of equipment buying but no one's ever happy with what I choose. How to fix this?

The baby cries all morning

Was the picture area of a CRT a parallelogram (instead of a true rectangle)?

How to verify if g is a generator for p?

Implement the Thanos sorting algorithm

How does residential electricity work?

voltage of sounds of mp3files

How can a jailer prevent the Forge Cleric's Artisan's Blessing from being used?

Can I use my Chinese passport to enter China after I acquired another citizenship?

Finding all intervals that match predicate in vector

Hide Select Output from T-SQL

How do I define a right arrow with bar in LaTeX?

Mapping a list into a phase plot

Minimal reference content

How can I get through very long and very dry, but also very useful technical documents when learning a new tool?

when is out of tune ok?

Why Were Madagascar and New Zealand Discovered So Late?

Is the destination of a commercial flight important for the pilot?

rsyslog 8.24 and multiple omfwd

rSyslog and short hostnameHow to restart rsyslog daemon on ubuntuwhat's causing rsyslog to log $msg**INVALID PROPERTY NAME** instead of the message contents from sonicwall devices?rsyslog starttls sslRsyslog stops sending data to remote server after log rotationrsyslog udp forwarding truncates at 2048 charactersRsyslog queues and performance impactsrsyslog TLS on AIXRsyslog hangs after memory usage 456 MBRsyslog notifications on multiple log entries

0

I want to forward *.* to remote host via TCP/IP.

Also, I have local0 facility where messages are plain JSON messages and they has to be forwarded to same host, but other port (and uses same certificate for gTLS).

I've made a config:

# provides UDP syslog reception 

$ModLoad imudp 

$UDPServerAddress 127.0.0.1 

$UDPServerRun 514



# provides TCP syslog reception 

$ModLoad imtcp 

$InputTCPServerRun 514



$template logFormat,"[1234] <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [type=syslog] %msg%n" 

$template logJSON,"{ "token": "1234", "env": "testfield" , %msg:2:$:%n" 

$WorkDirectory /var/spool/rsyslog # where to place spool files 

$ActionQueueFileName fwdRule1 # unique name prefix for spool files 

$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) 

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown 

$ActionQueueType LinkedList # run asynchronously 

$ActionResumeRetryCount -1 # infinite retries if host is down 

$DefaultNetstreamDriverCAFile /etc/ssl/certs/AddTrustExternalCARoot.crt



*.* action(type="omfwd" protocol="tcp" target="listener.example.com" port="5001" template="logFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.example.com") 

local0.info action(type="omfwd" protocol="tcp" target="listener.example.com" port="5005" template="logJSON" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.example.com") 

local0.* /var/log/app.log

Unfortunately, rsyslog doesn't even try to make a connection.
There's no evidence in netstat -nt, nor tcpdump

I'm looking for a way of forwarding those logstreams to their destinations without hacking it deeper in ELK stack. Can You help?

rsyslog elk

share

asked 4 mins ago

uosiuuosiu

1

New contributor

uosiu is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

add a comment | 

0

I want to forward *.* to remote host via TCP/IP.

Also, I have local0 facility where messages are plain JSON messages and they has to be forwarded to same host, but other port (and uses same certificate for gTLS).

I've made a config:

# provides UDP syslog reception 

$ModLoad imudp 

$UDPServerAddress 127.0.0.1 

$UDPServerRun 514



# provides TCP syslog reception 

$ModLoad imtcp 

$InputTCPServerRun 514



$template logFormat,"[1234] <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [type=syslog] %msg%n" 

$template logJSON,"{ "token": "1234", "env": "testfield" , %msg:2:$:%n" 

$WorkDirectory /var/spool/rsyslog # where to place spool files 

$ActionQueueFileName fwdRule1 # unique name prefix for spool files 

$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) 

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown 

$ActionQueueType LinkedList # run asynchronously 

$ActionResumeRetryCount -1 # infinite retries if host is down 

$DefaultNetstreamDriverCAFile /etc/ssl/certs/AddTrustExternalCARoot.crt



*.* action(type="omfwd" protocol="tcp" target="listener.example.com" port="5001" template="logFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.example.com") 

local0.info action(type="omfwd" protocol="tcp" target="listener.example.com" port="5005" template="logJSON" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.example.com") 

local0.* /var/log/app.log

Unfortunately, rsyslog doesn't even try to make a connection.
There's no evidence in netstat -nt, nor tcpdump

I'm looking for a way of forwarding those logstreams to their destinations without hacking it deeper in ELK stack. Can You help?

rsyslog elk

share

asked 4 mins ago

uosiuuosiu

1

New contributor

uosiu is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

add a comment | 

I want to forward *.* to remote host via TCP/IP.

Also, I have local0 facility where messages are plain JSON messages and they has to be forwarded to same host, but other port (and uses same certificate for gTLS).

I've made a config:

# provides UDP syslog reception 

$ModLoad imudp 

$UDPServerAddress 127.0.0.1 

$UDPServerRun 514



# provides TCP syslog reception 

$ModLoad imtcp 

$InputTCPServerRun 514



$template logFormat,"[1234] <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [type=syslog] %msg%n" 

$template logJSON,"{ "token": "1234", "env": "testfield" , %msg:2:$:%n" 

$WorkDirectory /var/spool/rsyslog # where to place spool files 

$ActionQueueFileName fwdRule1 # unique name prefix for spool files 

$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) 

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown 

$ActionQueueType LinkedList # run asynchronously 

$ActionResumeRetryCount -1 # infinite retries if host is down 

$DefaultNetstreamDriverCAFile /etc/ssl/certs/AddTrustExternalCARoot.crt



*.* action(type="omfwd" protocol="tcp" target="listener.example.com" port="5001" template="logFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.example.com") 

local0.info action(type="omfwd" protocol="tcp" target="listener.example.com" port="5005" template="logJSON" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.example.com") 

local0.* /var/log/app.log

Unfortunately, rsyslog doesn't even try to make a connection.
There's no evidence in netstat -nt, nor tcpdump

I'm looking for a way of forwarding those logstreams to their destinations without hacking it deeper in ELK stack. Can You help?

rsyslog elk

share

asked 4 mins ago

uosiuuosiu

1

New contributor

uosiu is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

# provides UDP syslog reception 

$ModLoad imudp 

$UDPServerAddress 127.0.0.1 

$UDPServerRun 514



# provides TCP syslog reception 

$ModLoad imtcp 

$InputTCPServerRun 514



$template logFormat,"[1234] <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [type=syslog] %msg%n" 

$template logJSON,"{ "token": "1234", "env": "testfield" , %msg:2:$:%n" 

$WorkDirectory /var/spool/rsyslog # where to place spool files 

$ActionQueueFileName fwdRule1 # unique name prefix for spool files 

$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) 

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown 

$ActionQueueType LinkedList # run asynchronously 

$ActionResumeRetryCount -1 # infinite retries if host is down 

$DefaultNetstreamDriverCAFile /etc/ssl/certs/AddTrustExternalCARoot.crt



*.* action(type="omfwd" protocol="tcp" target="listener.example.com" port="5001" template="logFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.example.com") 

local0.info action(type="omfwd" protocol="tcp" target="listener.example.com" port="5005" template="logJSON" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.example.com") 

local0.* /var/log/app.log

share

asked 4 mins ago

uosiuuosiu

1

New contributor

uosiu is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share

asked 4 mins ago

uosiuuosiu

1

New contributor

uosiu is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 4 mins ago

uosiuuosiu

1

New contributor

uosiu is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 4 mins ago

uosiuuosiu

1