implementing-syslog-centralization-with-rsyslog

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Implementing Syslog Centralization with Rsyslog

使用Rsyslog实现Syslog集中化

When to Use

适用场景

When deploying or configuring implementing syslog centralization with rsyslog capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

在您的环境中部署或配置基于rsyslog的syslog集中化功能时
建立符合合规要求的安全控制措施时
构建或改进该领域的安全架构时
开展需要此实现的安全评估时

Prerequisites

前提条件

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

熟悉安全运维概念与工具
可访问测试或实验室环境以安全执行操作
安装了Python 3.8+及所需依赖
拥有任何测试活动的适当授权

Instructions

操作步骤

Install dependencies:
```
pip install jinja2 paramiko
```
Generate TLS certificates for rsyslog server and clients using OpenSSL.
Run the agent to generate rsyslog server and client configurations:
- Server: TLS listener on port 6514, per-host directory output, JSON-format templates
- Client: TLS forwarding with disk-assisted queues for reliability
Deploy configurations to servers via SSH (paramiko).
Validate TLS connectivity and log delivery.

bash

python scripts/agent.py --server-ip 10.0.0.1 --clients 10.0.0.10,10.0.0.11 --ca-cert ca.pem --output syslog_report.json

安装依赖：
```
pip install jinja2 paramiko
```
使用OpenSSL为rsyslog服务器和客户端生成TLS证书。
运行agent生成rsyslog服务器和客户端配置：
- 服务器：6514端口的TLS监听器，按主机目录输出，JSON格式模板
- 客户端：带磁盘辅助队列的TLS转发以确保可靠性
通过SSH（paramiko）将配置部署到服务器。
验证TLS连接和日志交付。

bash

python scripts/agent.py --server-ip 10.0.0.1 --clients 10.0.0.10,10.0.0.11 --ca-cert ca.pem --output syslog_report.json

Examples

示例

Server Configuration (TLS)

服务器配置（TLS）

module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1"
       StreamDriver.Authmode="x509/name")
input(type="imtcp" port="6514")
template(name="PerHostLog" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?PerHostLog

module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1"
       StreamDriver.Authmode="x509/name")
input(type="imtcp" port="6514")
template(name="PerHostLog" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?PerHostLog

Client Configuration (Reliable Forwarding)

客户端配置（可靠转发）

action(type="omfwd" target="10.0.0.1" port="6514" protocol="tcp"
       StreamDriver="gtls" StreamDriverMode="1"
       StreamDriverAuthMode="x509/name"
       queue.type="LinkedList" queue.filename="fwdRule1"
       queue.maxdiskspace="1g" queue.saveonshutdown="on"
       action.resumeRetryCount="-1")

action(type="omfwd" target="10.0.0.1" port="6514" protocol="tcp"
       StreamDriver="gtls" StreamDriverMode="1"
       StreamDriverAuthMode="x509/name"
       queue.type="LinkedList" queue.filename="fwdRule1"
       queue.maxdiskspace="1g" queue.saveonshutdown="on"
       action.resumeRetryCount="-1")