I am trying to set this up for SIEM ingestion on RHEL 8. I have this configuration below, however, the normal non-tls TCP doesn't work.
I know the problem is because I have gtls globally and in my imtcp module - that is obvious, but what I cannot find is how to add this configuration into just a single input template that I can add to each need ruleset. Can that even be done?
I have tried adding the following into my input template to no avail. They seem deprecated.
I tried adding:
(1)
StreamDriver.Name="gtls"
StreamDriver.Mode="1"
StreamDriver.Authmode="anon"
(2)
Tag="ssl"
(3)
tls="on"
tls.caCert="/etc/rsyslog.d/certs/CA.pem"
tls.myCert="/etc/rsyslog.d/certs/server.pem"
tls.myPrivKey="/etc/rsyslog.d/certs/Key.key"
tls.authmode="name"
Any suggestions would be greatly appreciated.
########## MODULES ##########
module(load="imudp")
module(load="imtcp" MaxSessions="500"
StreamDriver.Name="gtls"
StreamDriver.Mode="1"
StreamDriver.Authmode="anon"
)
########## TEMPLATES ##########
template(name="FileFormat" type="list") {
property(name="rawmsg-after-pri")
constant(value="\n")
}
# make gtls driver the default and set certificate files
global(
DefaultNetstreamDriver="gtls"
DefaultNetstreamDriverCAFile="/etc/rsyslog.d/certs/CA.pem"
DefaultNetstreamDriverCertFile="/etc/rsyslog.d/certs/server.pem"
DefaultNetstreamDriverKeyFile="/etc/rsyslog.d/certs/Key.key"
)
# semanage port -a -t syslogd_port_t -p udp <port>
############### udp_input ###############
input(type="imudp" port="8501" ruleset="udp_input")
template(name="udp_input" type="string" string="var/log/remote/udp_input/%HOSTNAME%/%$day%_%$hour%.log")
ruleset(name="udp_input"){
action(
type="omfile"
dirCreateMode="0755"
template="FileFormat"
dynafile="udp_input"
)
}
# semanage port -a -t syslogd_port_t -p tcp <port>
############### TCP_input ###############
input(type="imtcp" port="8502" ruleset="TCP_input")
template(name="TCP_input" type="string" string="var/log/remote/TCP_input/%HOSTNAME%/%$day%_%$hour%.log")
ruleset(name="TCP_input"){
action(
type="omfile"
dirCreateMode="0755"
template="FileFormat"
dynafile="TCP_input"
)
}
# semanage port -a -t syslog_tls_port_t -p tcp <port>
############### tls_input ###############
input(type="imtcp" port="8611" ruleset="tls_input")
template(name="tls_input" type="string" string="var/log/remote/tls_input/%HOSTNAME%/%$day%_%$hour%.log")
ruleset(name="tls_input"){
action(
type="omfile"
dirCreateMode="0755"
template="FileFormat"
dynafile="tls_input"
)
}
I have modules:
rsyslog.x86_64
rsyslog-gnutls.x86_64
rsyslog-gssapi.x86_64
rsyslog-relp.x86_64
