Sending TufinOS 4.x Logs to a Remote Host

Overview

RSyslog is a log processing utility that facilitates the sending of TOS internal log details to a remote syslog server.

This topic is not related to sending accountability or any other device information from devices to TOS.

We recommend not using the local logging of RSyslog because TufinOS 4 uses the systemd-journald service for system event interpretation and recording by default. Using the RSyslog for local logging will double the recorded system event messages and increase disk usage. However, if you decide to use RSyslog for local logging, do not change the RSyslog log rotation configuration in the file /etc/logrotate.d/syslog. Check the free space in the /var/log partition periodically. If you do not have at least 10% of the partition size as free space, disable RSyslog. For more information, see Disable Local Logging of RSyslog.

In TufinOS 4, RSyslog is supported from TufinOS 4.30.

Prerequisites

Before you proceed, log in as a root user with root user environment variables. If you have logged in as a regular user, use the sudo su - command to switch to the root user. If the sudo command is not configured, use the su - command.

Check Current RSyslog

Confirm that an auditing RSyslog destination exists.

To determine if the RSyslog is already configured to send logs to a remote host, review the /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files and verify that logs are sent to a central host (where loghost.example.com is the name of your central log host):
```
grep -E '^\s*([^#]+\s+)?action\(([^#]+\s+)?\btarget=\"?[^#"]+\"?\b' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
```
grep -E '^\s*([^#]+\s+)?action\(([^#]+\s+)?\btarget=\"?[^#"]+\"?\b' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should include target=<FQDN or IP of remote loghost>, for example:
```
*.* action(type="omfwd" target="loghost.example.com" port="514" protocol="tcp"
```
If this command is unsuccessful, use the following command instead:
```
grep "^*.*[^I][^I]*@" /etc/rsyslog.conf /etc/rsyslog.d/*.conf
```
grep "^*.*[^I][^I]*@" /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should include @@<FQDN or IP of remote loghost>, for example:
```
*.* @@loghost.example.com
```
If RSyslog is configured to send logs to a remote host, verify that it is running and enabled.
1. Verify that the RSyslog service is running:
```
systemctl is-active rsyslog.service
```
  systemctl is-active rsyslog.service
  The expected result is active.
2. Verify that the RSyslog service is enabled:
```
systemctl is-enabled rsyslog.service
```
  systemctl is-enabled rsyslog.service
  The expected result is enabled.

Configure RSyslog

Use this procedure to activate RSyslog if it is not already active.

Create the /etc/rsyslog.d/log_to_remote.conf file and add the following line (where <IP> is the IP address of your central log host and <port> is the port of your central log host). The target directive can be a Fully Qualified Domain Name (FQDN) or an IP address.
```
*.* action(type="omfwd" target="<IP>" port="<port>" protocol="tcp" action.resumeRetryCount="100" queue.type="LinkedList" queue.size="1000")
```
*.* action(type="omfwd" target="<IP>" port="<port>" protocol="tcp" action.resumeRetryCount="100" queue.type="LinkedList" queue.size="1000")

Test the configuration syntax:

rsyslogd -N 1

rsyslogd -N 1

Verify that your output is similar to the following example:

rsyslogd: version 8.2102.0-15.el8, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.

Disable Local Logging of RSyslog

Locate and comment out these eight RSyslog rules in the configuration file /etc/rsyslog.conf as shown in this example:

#kern.*                                                 /dev/console

#*.info;mail.none;authpriv.none;cron.none                /var/log/messages

#authpriv.*                                              /var/log/secure

#mail.*                                                  -/var/log/maillog

#cron.*                                                  /var/log/cron

#*.emerg                                                 :omusrmsg:*

#uucp,news.crit                                          /var/log/spooler

#local7.*                                                /var/log/boot.log

Test the configuration syntax:
```
rsyslogd -N 1
```
rsyslogd -N 1

Verify that your output is similar to the following example:

rsyslogd: version 8.2102.0-15.el8, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.

Enable and Start the RSyslog Service

After you complete the RSyslog configuration, unmask, enable, and start the service.

Unmask the service:
```
systemctl unmask rsyslog.service
```
systemctl unmask rsyslog.service
Enable the service:
```
systemctl enable rsyslog.service
```
systemctl enable rsyslog.service
Start the service:
```
systemctl start rsyslog.service
```
systemctl start rsyslog.service
Check the service status:
```
systemctl status rsyslog.service
```
systemctl status rsyslog.service