You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
110 lines
3.8 KiB
110 lines
3.8 KiB
# Configuration rsyslog pour utiliser avec un Splunk Forwarder a copier dans /etc/rsyslog.d
|
|
|
|
#--------------------------Modules-----------------------------
|
|
|
|
$ModLoad imudp
|
|
$ModLoad imtcp
|
|
|
|
#--------------------------Protocoles--------------------------
|
|
|
|
$UDPServerRun 514
|
|
$UDPServerRun 5140
|
|
$InputTCPServerRun 514
|
|
|
|
#--------------------------Folder------------------------------
|
|
|
|
$DirCreateMode 0755
|
|
$FileCreateMode 0640
|
|
$DirOwner splunk
|
|
$DirGroup splunk
|
|
$FileOwner splunk
|
|
$FileGroup splunk
|
|
|
|
$RuleSet RSYSLOG_DefaultRuleSet
|
|
|
|
#--------------------------Templates---------------------------
|
|
|
|
# Template pour Fortigate
|
|
template(name="fortigate" type="string" string="/var/rsyslog/%$myhostname%/fortigate/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log")
|
|
|
|
# Template pour ESXi
|
|
template(name="esxi" type="string" string="/var/rsyslog/%$myhostname%/esxi/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log")
|
|
|
|
# Template pour Linux
|
|
template(name="linux" type="string" string="/var/rsyslog/%$myhostname%/linux/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log")
|
|
|
|
# Template pour Switch alcatel
|
|
template(name="alcatel_omniswitch" type="string" string="/var/rsyslog/%$myhostname%/alcatel_omniswitch/%$YEAR%-%$MONTH%-%$DAY%/%fromhost-ip%/%syslogfacility-text%.log")
|
|
|
|
# Template pour ILO
|
|
template(name="ilo" type="string" string="/var/rsyslog/%$myhostname%/ilo/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log")
|
|
|
|
# Template pour les equipement réseau
|
|
template(name="network" type="string" string="/var/rsyslog/%$myhostname%/network/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log")
|
|
|
|
# Template pour iDRAC
|
|
template(name="idrac" type="string" string="/var/rsyslog/%$myhostname%/idrac/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log")
|
|
|
|
# Template Catch-All
|
|
template(name="catchall" type="string" string="/var/rsyslog/%$myhostname%/catchall/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log")
|
|
|
|
#-------------------------Filtres et Actions------------------------------
|
|
|
|
# Fortigate (identifié par 'devid="FG' dans le message)
|
|
if $msg contains_i ' devid="FG' then {
|
|
action(type="omfile" dynaFile="fortigate")
|
|
stop
|
|
}
|
|
|
|
# ESXi (hôte commençant par 'spv')
|
|
if $fromhost startswith "spv" then {
|
|
action(type="omfile" dynaFile="esxi")
|
|
stop
|
|
}
|
|
|
|
# Linux (hôte ou nom contenant 'svl')
|
|
if $fromhost startswith "svl" or $hostname contains 'svl' then {
|
|
action(type="omfile" dynaFile="linux")
|
|
stop
|
|
}
|
|
|
|
# Cisco ASA (identifié par '%ASA' dans le tag syslog)
|
|
if $syslogtag contains '%ASA' then {
|
|
action(type="omfile" dynaFile="network")
|
|
stop
|
|
}
|
|
|
|
# ILO (identifié par 'ILO' dans le message)
|
|
if $msg contains_i "ILO" then {
|
|
action(type="omfile" dynaFile="ilo")
|
|
stop
|
|
}
|
|
|
|
# iDRAC (nom d'hôte contenant 'IDR')
|
|
if $hostname contains_i "IDR" then {
|
|
action(type="omfile" dynaFile="idrac")
|
|
stop
|
|
}
|
|
|
|
# Réseau spécifique
|
|
if ($fromhost-ip startswith '223.90.0' or $fromhost-ip startswith '223.94.0') then {
|
|
action(type="omfile" dynaFile="alcatel_omniswitch")
|
|
stop
|
|
}
|
|
|
|
# Catch-All (tous les autres logs)
|
|
if $fromhost != $$myhostname then {
|
|
action(type="omfile" dynaFile="catchall")
|
|
stop
|
|
}
|
|
|
|
#----------------------- Options additionnelles -----------------------
|
|
|
|
# Utilisation d'une file d'attente asynchrone pour améliorer les performances
|
|
# Permet d'assurer un traitement non bloquant des logs en cas de surcharge
|
|
$ActionQueueType LinkedList # Type de queue : liste chaînée (asynchrone)
|
|
$ActionQueueFileName syslogqueue # Nom du fichier de queue
|
|
$ActionResumeRetryCount -1 # Retenter indéfiniment si le serveur de logs est indisponible
|
|
|
|
# Utilisation du format Syslog Protocol 23 (compatibilité maximale)
|
|
$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format |