Logging Scenario - Logging with Rsyslog
Last modified on October 4, 2023
Scenario: You want to deliver your logs via TCP/syslog to a logging service on a server with Rsyslog. You can do this through your Gateway/Relay server with a little setup.
sdm audit activitiescommand.
- On the logging server (i.e., the target/destination to which the logs will be written), edit the
/etc/rsyslog.conffile and add the following lines:
#Provides TCP syslog reception $ModLoad imtcp $InputTCPServerRun 514 # You can optionally use $InputTCPMaxSessions to specify a maximum amount of connections # $InputTCPMaxSessions 500 # Sets up logging so that the hostname and program name are visible in order to better parse logs for sdm. $template RemoteLogs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log" *.* ?RemoteLogs
- On the logging client (the Gateway/Relay server), edit
/etc/rsyslog.d/loghost.confand add the IP address of the logging server (the target server, not the Gateway/Relay) along with the port it is listening on:
- On the Admin UI > Settings page, select Log Encryption & Storage, select Log locally on relays, and then under Local storage select syslog. Add the IP address of the logging server along with the port it is listening on:
Now you have configured StrongDM to send logs to your Gateway/Relay server and then deliver them to another target service.