blob: 3eb6f258a65f3c278cf0d34106e5d423c0ccecb8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
|
### Autogenerated by system_syslog.py ###
#### MODULES ####
# Load input modules for local logging and journald
# Old-style log file format with low-precision timestamps
# A modern-style logfile format with high-precision timestamps and timezone info
# RSYSLOG_FileFormat
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
module(load="imuxsock") # provides support for local system logging (collection from /dev/log unix socket)
# Import logs from journald, which includes kernel log messages
module(
load="imjournal"
StateFile="/var/spool/rsyslog/imjournal.state" # Persistent state file to track the journal cursor
Ratelimit.Interval="0" # Disable rate limiting (set to "0" for no limit)
RateLimit.Burst="0"
)
###########################
#### GLOBAL DIRECTIVES ####
###########################
# Log specific programs to auth.log, then stop further processing
if (
$programname == "CRON" or
$programname == "sudo" or
$programname == "su"
) then {
action(type="omfile" file="/var/log/auth.log")
stop
}
global(workDirectory="/var/spool/rsyslog")
###############
#### RULES ####
###############
# Send emergency messages to all logged-in users
*.emerg action(type="omusrmsg" users="*")
{% if marker is vyos_defined and marker.disable is not vyos_defined %}
# Load the immark module for periodic --MARK-- message capability
module(load="immark" interval="{{ marker.interval }}")
{% endif %}
{% if preserve_fqdn is vyos_defined %}
# Preserve the fully qualified domain name (FQDN) in log messages
global(preserveFQDN="on")
{% if preserve_fqdn.host_name is vyos_defined and preserve_fqdn.domain_name is vyos_defined %}
# Set the local hostname for log messages
global(localHostname="{{ preserve_fqdn.host_name }}.{{ preserve_fqdn.domain_name }}")
{% endif %}
{% endif %}
{# Build a prifilt selector list with "all" excluding any explicitly-set facilities #}
{% macro prifilt_selectors(facility_map) %}
{# pass 1: collect explicit facilities #}
{% set selectors = [] %}
{% set keys = facility_map.keys() | list | sort %}
{% set specific = [] %}
{% for facility in keys %}
{% if facility != 'all' %}
{% set _ = specific.append(facility) %}
{% endif %}
{% endfor %}
{# pass 2: build selectors; add ;fac.none exclusions to wildcard #}
{% for facility in keys %}
{% set opts = facility_map[facility] %}
{% set level = opts.level.replace('all', 'debug') %}
{% if facility == 'all' %}
{% set ns = namespace(sel="*." ~ level) %}
{% for sf in specific %}
{% set ns.sel = ns.sel ~ ";" ~ sf ~ ".none" %}
{% endfor %}
{% set sel = ns.sel %}
{% else %}
{% set sel = facility ~ "." ~ level %}
{% endif %}
{% set _ = selectors.append(sel) %}
{% endfor %}
{{ selectors | join(',') }}
{% endmacro %}
#### GLOBAL LOGGING ####
{% if local.facility is vyos_defined %}
if prifilt("{{ prifilt_selectors(local.facility) | trim }}") then {
action(
type="omfile"
file="/var/log/messages"
rotation.sizeLimit="{{ logrotate_size_limit }}" # maximum filesize before rotation
rotation.sizeLimitCommand="/usr/sbin/logrotate {{ logrotate }}"
)
}
{% endif %}
#### CONSOLE LOGGING ####
{% if console.facility is vyos_defined %}
if prifilt("{{ prifilt_selectors(console.facility) | trim }}") then {
action(type="omfile" file="/dev/console")
}
{% endif %}
#### REMOTE LOGGING ####
{% if remote is vyos_defined %}
{% for remote_name, remote_options in remote.items() %}
{% if remote_options.facility is vyos_defined %}
{% set tls = remote_options.tls %}
# Remote syslog to {{ remote_name }}
if prifilt("{{ prifilt_selectors(remote_options.facility) | trim }}") then {
action(
type="omfwd"
# Remote syslog server where we send our logs to
target="{{ remote_name }}"
# Port on the remote syslog server
port="{{ remote_options.port }}"
protocol="{{ 'tcp' if tls is vyos_defined else remote_options.protocol }}"
{% if remote_options.format.include_timezone is vyos_defined %}
template="RSYSLOG_SyslogProtocol23Format"
{% endif %}
TCP_Framing="{{ 'octet-counted' if remote_options.format.octet_counted is vyos_defined else 'traditional' }}"
{% if remote_options.source_address is vyos_defined %}
Address="{{ remote_options.source_address }}"
{% endif %}
{% if remote_options.vrf is vyos_defined %}
Device="{{ remote_options.vrf }}"
{% endif %}
{% if tls is vyos_defined %}
{% set auth_mode = tls.auth_mode %}
# Specify the use of the OpenSSL TLS driver for this action
StreamDriver="ossl"
# Set mode to TLS-only connections (do not accept plain TCP)
StreamDriverMode="1"
# Select the authentication mode
StreamDriverAuthMode="{{ auth_mode if auth_mode == 'anon' else 'x509/' + auth_mode }}"
{% if tls.permitted_peer is vyos_defined and auth_mode in ('fingerprint', 'name') %}
{% set permitted_peers = tls.permitted_peer | map('trim') | select | join(',') %}
{% if permitted_peers %}
# Only include permitted peers (list of allowed fingerprints or names)
StreamDriverPermittedPeers="{{ permitted_peers }}"
{% endif %}
{% endif %}
{% if tls.ca_certificate_path is vyos_defined %}
# Include the path to the CA certificate file
StreamDriver.CAFile="{{ tls.ca_certificate_path }}"
{% endif %}
{% if tls.certificate_path is vyos_defined %}
# Include the path to the client's certificate
StreamDriver.CertFile="{{ tls.certificate_path }}"
{% endif %}
{% if tls.certificate_key_path is vyos_defined %}
# Include the path to the client's private key
StreamDriver.KeyFile="{{ tls.certificate_key_path }}"
{% endif %}
{% endif %}
)
}
{% endif %}
{% endfor %}
{% endif %}
# Include all configuration files in /etc/rsyslog.d/
include(file="/etc/rsyslog.d/*.conf")
|
