Page: Home

Home

gg

HTTPS

2 Home

phschoen edited this page 2 months ago

# Forward journald + auditd to Graylog via UDP/514
# Ubuntu/RHEL compatible rsyslog config

module(load="imuxsock")   # classic /dev/log
module(load="imjournal" StateFile="imjournal.state")
module(load="imfile")

# --- Audit log file ---
input(
  type="imfile"
  File="/var/log/audit/audit.log"
  Tag="auditd:"
  Facility="local5"
  Severity="info"
  PersistStateInterval="100"
  ReadMode="2"
)

# --- Template with journal/systemd metadata embedded ---
template(name="GraylogSyslogWithFields" type="string"
  string="<%pri%>%timestamp:::date-rfc3339% %hostname% %syslogtag% UNIT=\"%$!_SYSTEMD_UNIT%\" COMM=\"%$!_COMM%\" EXE=\"%$!_EXE%\" PID=\"%$!_PID%\" UID=\"%$!_UID%\" GID=\"%$!_GID%\" SYSLOG_IDENTIFIER=\"%$!SYSLOG_IDENTIFIER%\" MESSAGE=\"%msg%\"\n"
)

# --- Send everything to Graylog UDP/514 ---
*.* action(
  type="omfwd"
  target="graylog.local"
  port="514"
  protocol="udp"
  template="GraylogSyslogWithFields"
)


#UNIT:sshd.service
#UNIT:NetworkManager.service
#COMM:sudo
#COMM:podman
#EXE:/usr/bin/podman
#PID:1234

# Forward journald + auditd to Graylog via UDP/514
# Ubuntu/RHEL compatible rsyslog config

module(load="imuxsock")   # classic /dev/log
module(load="imjournal" StateFile="imjournal.state")
module(load="imfile")

# --- Audit log file ---
input(
  type="imfile"
  File="/var/log/audit/audit.log"
  Tag="auditd:"
  Facility="local5"
  Severity="info"
  PersistStateInterval="100"
  ReadMode="2"
)

# --- Template with journal/systemd metadata embedded ---
template(name="GraylogSyslogWithFields" type="string"
  string="<%pri%>%timestamp:::date-rfc3339% %hostname% %syslogtag% UNIT=\"%$!_SYSTEMD_UNIT%\" COMM=\"%$!_COMM%\" EXE=\"%$!_EXE%\" PID=\"%$!_PID%\" UID=\"%$!_UID%\" GID=\"%$!_GID%\" SYSLOG_IDENTIFIER=\"%$!SYSLOG_IDENTIFIER%\" MESSAGE=\"%msg%\"\n"
)

# --- Send everything to Graylog UDP/514 ---
*.* action(
  type="omfwd"
  target="graylog.local"
  port="514"
  protocol="udp"
  template="GraylogSyslogWithFields"
)

# Forward Linux logs to Graylog
# Uses UDP/514 as requested.
# For critical audit/security logs, TCP is better, but this keeps your setup.

module(load="imuxsock")   # /dev/log
module(load="imjournal" StateFile="imjournal.state")
module(load="imfile")

# -------------------------
# AuditD file input
# -------------------------
input(
  type="imfile"
  File="/var/log/audit/audit.log"
  Tag="auditd:"
  Facility="local5"
  Severity="info"
  PersistStateInterval="100"
  ReadMode="2"
)

# -------------------------
# Graylog syslog template
# Adds useful searchable fields into the message.
# Parse these in Graylog with key_value().
# -------------------------
template(name="GraylogSyslogWithFields" type="string"
  string="<%pri%>%timestamp:::date-rfc3339% %hostname% %syslogtag% HOST=\"%hostname%\" APP=\"%programname%\" FACILITY=\"%syslogfacility-text%\" SEVERITY=\"%syslogseverity-text%\" UNIT=\"%$!_SYSTEMD_UNIT%\" COMM=\"%$!_COMM%\" EXE=\"%$!_EXE%\" PID=\"%$!_PID%\" UID=\"%$!_UID%\" GID=\"%$!_GID%\" SYSLOG_IDENTIFIER=\"%$!SYSLOG_IDENTIFIER%\" MESSAGE=\"%msg:::drop-last-lf%\"\n"
)

# -------------------------
# Optional noise reduction
# Uncomment only if needed
# -------------------------
# if $programname == "graylog-server" then stop
# if $msg contains "UFW BLOCK" then stop

# -------------------------
# Forward everything to Graylog UDP/514
# -------------------------
*.* action(
  type="omfwd"
  target="graylog.local"
  port="514"
  protocol="udp"
  template="GraylogSyslogWithFields"

  # Local queue before sending
  queue.type="LinkedList"
  queue.filename="graylog_fwd"
  queue.maxdiskspace="1g"
  queue.saveonshutdown="on"
)

graylog pipline rules

rule "parse rsyslog graylog fields"
when
  has_field("message") &&
  contains(to_string($message.message), "HOST=")
then
  let fields = key_value(
    value: to_string($message.message),
    delimiters: " ",
    kv_delimiters: "=",
    trim_value_chars: "\""
  );

  set_fields(fields);
end

fields: HOST APP UNIT SEVERITY FACILITY source

System → Content Packs

1. Pipeline rule: parse rsyslog fields
2. Stream: Linux Syslog
3. Dashboard: Linux Asset Detail
4. Export all as Content Pack

Pipeline rule: parse HOST, APP, UNIT, COMM, EXE, PID, SEVERITY, FACILITY

Stream: Linux Syslog where HOST exists

Dashboard: Linux Asset Detail with dashboard parameters: asset = HOST unit = UNIT

Then widget queries: HOST:$asset$ HOST:$asset$ AND UNIT:$unit$ HOST:$asset$ AND SEVERITY:(err OR crit OR alert OR emerg) HOST:$asset$ AND APP:sshd HOST:$asset$ AND APP:sudo HOST:$asset$ AND APP:auditd