Add 'Home'

Home.md

@@ -0,0 +1,155 @@
+```
+# Forward journald + auditd to Graylog via UDP/514
+# Ubuntu/RHEL compatible rsyslog config
+
+module(load="imuxsock")   # classic /dev/log
+module(load="imjournal" StateFile="imjournal.state")
+module(load="imfile")
+
+# --- Audit log file ---
+input(
+  type="imfile"
+  File="/var/log/audit/audit.log"
+  Tag="auditd:"
+  Facility="local5"
+  Severity="info"
+  PersistStateInterval="100"
+  ReadMode="2"
+)
+
+# --- Template with journal/systemd metadata embedded ---
+template(name="GraylogSyslogWithFields" type="string"
+  string="<%pri%>%timestamp:::date-rfc3339% %hostname% %syslogtag% UNIT=\"%$!_SYSTEMD_UNIT%\" COMM=\"%$!_COMM%\" EXE=\"%$!_EXE%\" PID=\"%$!_PID%\" UID=\"%$!_UID%\" GID=\"%$!_GID%\" SYSLOG_IDENTIFIER=\"%$!SYSLOG_IDENTIFIER%\" MESSAGE=\"%msg%\"\n"
+)
+
+# --- Send everything to Graylog UDP/514 ---
+*.* action(
+  type="omfwd"
+  target="graylog.local"
+  port="514"
+  protocol="udp"
+  template="GraylogSyslogWithFields"
+)
+
+
+#UNIT:sshd.service
+#UNIT:NetworkManager.service
+#COMM:sudo
+#COMM:podman
+#EXE:/usr/bin/podman
+#PID:1234
+
+
+
+```
+
+```
+# Forward journald + auditd to Graylog via UDP/514
+# Ubuntu/RHEL compatible rsyslog config
+
+module(load="imuxsock")   # classic /dev/log
+module(load="imjournal" StateFile="imjournal.state")
+module(load="imfile")
+
+# --- Audit log file ---
+input(
+  type="imfile"
+  File="/var/log/audit/audit.log"
+  Tag="auditd:"
+  Facility="local5"
+  Severity="info"
+  PersistStateInterval="100"
+  ReadMode="2"
+)
+
+# --- Template with journal/systemd metadata embedded ---
+template(name="GraylogSyslogWithFields" type="string"
+  string="<%pri%>%timestamp:::date-rfc3339% %hostname% %syslogtag% UNIT=\"%$!_SYSTEMD_UNIT%\" COMM=\"%$!_COMM%\" EXE=\"%$!_EXE%\" PID=\"%$!_PID%\" UID=\"%$!_UID%\" GID=\"%$!_GID%\" SYSLOG_IDENTIFIER=\"%$!SYSLOG_IDENTIFIER%\" MESSAGE=\"%msg%\"\n"
+)
+
+# --- Send everything to Graylog UDP/514 ---
+*.* action(
+  type="omfwd"
+  target="graylog.local"
+  port="514"
+  protocol="udp"
+  template="GraylogSyslogWithFields"
+)
+
+```
+
+```
+# Forward Linux logs to Graylog
+# Uses UDP/514 as requested.
+# For critical audit/security logs, TCP is better, but this keeps your setup.
+
+module(load="imuxsock")   # /dev/log
+module(load="imjournal" StateFile="imjournal.state")
+module(load="imfile")
+
+# -------------------------
+# AuditD file input
+# -------------------------
+input(
+  type="imfile"
+  File="/var/log/audit/audit.log"
+  Tag="auditd:"
+  Facility="local5"
+  Severity="info"
+  PersistStateInterval="100"
+  ReadMode="2"
+)
+
+# -------------------------
+# Graylog syslog template
+# Adds useful searchable fields into the message.
+# Parse these in Graylog with key_value().
+# -------------------------
+template(name="GraylogSyslogWithFields" type="string"
+  string="<%pri%>%timestamp:::date-rfc3339% %hostname% %syslogtag% HOST=\"%hostname%\" APP=\"%programname%\" FACILITY=\"%syslogfacility-text%\" SEVERITY=\"%syslogseverity-text%\" UNIT=\"%$!_SYSTEMD_UNIT%\" COMM=\"%$!_COMM%\" EXE=\"%$!_EXE%\" PID=\"%$!_PID%\" UID=\"%$!_UID%\" GID=\"%$!_GID%\" SYSLOG_IDENTIFIER=\"%$!SYSLOG_IDENTIFIER%\" MESSAGE=\"%msg:::drop-last-lf%\"\n"
+)
+
+# -------------------------
+# Optional noise reduction
+# Uncomment only if needed
+# -------------------------
+# if $programname == "graylog-server" then stop
+# if $msg contains "UFW BLOCK" then stop
+
+# -------------------------
+# Forward everything to Graylog UDP/514
+# -------------------------
+*.* action(
+  type="omfwd"
+  target="graylog.local"
+  port="514"
+  protocol="udp"
+  template="GraylogSyslogWithFields"
+
+  # Local queue before sending
+  queue.type="LinkedList"
+  queue.filename="graylog_fwd"
+  queue.maxdiskspace="1g"
+  queue.saveonshutdown="on"
+)
+```
+
+
+graylog pipline rules
+```
+rule "parse rsyslog graylog fields"
+when
+  has_field("message") &&
+  contains(to_string($message.message), "HOST=")
+then
+  let fields = key_value(
+    value: to_string($message.message),
+    delimiters: " ",
+    kv_delimiters: "=",
+    trim_value_chars: "\""
+  );
+
+  set_fields(fields);
+end
+```
+