You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
79 lines
2.2 KiB
79 lines
2.2 KiB
# Configuration rsyslog pour utiliser avec un Splunk Forwarder a copier dans /etc/rsyslog.d
|
|
|
|
#--------------------------Modules-----------------------------
|
|
|
|
$ModLoad imudp
|
|
$ModLoad imtcp
|
|
|
|
#--------------------------Protocoles--------------------------
|
|
|
|
$UDPServerRun 514
|
|
$UDPServerRun 5140
|
|
$InputTCPServerRun 514
|
|
|
|
#--------------------------Folder------------------------------
|
|
|
|
$DirCreateMode 0755
|
|
$FileCreateMode 0640
|
|
$DirOwner splunk
|
|
$DirGroup splunk
|
|
$FileOwner splunk
|
|
$FileGroup splunk
|
|
|
|
$RuleSet RSYSLOG_DefaultRuleSet
|
|
|
|
#--------------------------Templates---------------------------
|
|
|
|
#Template Cisco
|
|
$template ciscoasa,"/var/rsyslog/%$myhostname%/ciscoasa/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log"
|
|
|
|
#Template Fortigate
|
|
$template fortigate,"/var/rsyslog/%$myhostname%/fortigate/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log"
|
|
|
|
#Template Esxi
|
|
$template esxi,"/var/rsyslog/%$myhostname%/esxi/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log"
|
|
|
|
#Template Linux
|
|
$template linux,"/var/rsyslog/%$myhostname%/linux/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log"
|
|
|
|
#Template Switch
|
|
$template switch,"/var/rsyslog/%$myhostname%/switch/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log"
|
|
|
|
#Templates ILO
|
|
$template ilo,"/var/rsyslog/%$myhostname%/ilo/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log"
|
|
|
|
#Templates iDRAC
|
|
$template ilo,"/var/rsyslog/%$myhostname%/idrac/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log"
|
|
|
|
# Catch All
|
|
$template catchother,"/var/rsyslog/%$myhostname%/catchother/%$YEAR%-%$MONTH%-%$DAY%/%HOSTNAME%/%syslogfacility-text%.log"
|
|
|
|
#-------------------------Filtres------------------------------
|
|
|
|
if $msg contains_i ' devid="FG' then -?fortigate
|
|
& stop
|
|
|
|
if $fromhost startswith "spv" then -?esxi
|
|
& stop
|
|
|
|
if $fromhost startswith "svl" then -?linux
|
|
& stop
|
|
|
|
if $hostname contains 'svl' then -?linux
|
|
& stop
|
|
|
|
if $hostname contains 'SWI' then -?switch
|
|
& stop
|
|
|
|
if $syslogtag contains '%ASA' then -?ciscoasa
|
|
& stop
|
|
|
|
if $msg contains_i "ILO" then -?ilo
|
|
& stop
|
|
|
|
if $hostname contains_i "IDR" then -?idrac
|
|
& stop
|
|
|
|
if $fromhost != $$myhostname then -?catchother
|
|
& stop
|