Skip to content

Commit 2f42c20

Browse files
baszoetekouwbaszoetekouw
committed
syslog: generate ruleset and template from simple(r) yaml config
1 parent 153f72d commit 2f42c20

4 files changed

Lines changed: 91 additions & 107 deletions

File tree

‎.ansible-lint‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
11
---
22
profile: "production"
33
offline: false
4+
5+
skip_list:
6+
- yaml[colons]

‎roles/rsyslog/defaults/main.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
rsyslog_ca: /etc/pki/rsyslog/rsyslog_ca.pem
23
rsyslog_dir: /opt/openconext/logs
34
rsyslog_read_group: adm
@@ -40,3 +41,60 @@ rsyslog_checkemptylogs_cron_minute: "0"
4041
rsyslog_checkemptylogs_cron_hour: "9"
4142
rsyslog_checkemptylogs_cron_weekdays: "1-5"
4243
rsyslog_checkemptylogs_dir: "/usr/local/bin"
44+
45+
# "program" matches the syslog identifier
46+
# "contains" and "startswith" match the syslog message
47+
rsyslog_central_apps:
48+
haproxy: { program: "haproxy", target: "haproxy/haproxy.log" }
49+
keepalived: { program: "Keepalived_vrrp", target: "keepalived/keepalived.log" }
50+
galera: { program: "mariadb", target: "galera/galera.log" }
51+
galera_garb: { program: "garb-systemd", target: "galera/galera_garb.log" }
52+
mongo: { program: "mongod", target: "mongo/mongo.log" }
53+
traefik: { program: "loadbalancer", target: "traefik/traefik.log" }
54+
eb_auth: { program: "engineblock", contains: '"channel":"authentication"',
55+
dir: "log_logins", target: "eb-authentication.log" }
56+
stepup_auth1: { program: "gateway", contains: '"message":"Second Factor Authenticated"',
57+
dir: "log_logins", target: "stepup-authentication.log" }
58+
stepup_auth2: { program: "gateway", contains: '"message":"Intrinsic Loa Requested"',
59+
dir: "log_logins", target: "stepup-authentication.log" }
60+
stepup_auth3: { program: "stepup-authentication",
61+
dir: "log_logins", target: "stepup-authentication.log" }
62+
eb_apache: { program: "engineblock", startswith: "engine",
63+
target: "eb/apache.log" }
64+
eb: { program: "engineblock", target: "eb/eb.log" }
65+
eb_log: { program: "EBLOG", target: "eb/eb.log" }
66+
eb_apache2: { program: "Apache-EB", target: "eb/apache.log" } # probabaly ununsed
67+
eb_api: { program: "Apache-EBAPI", target: "eb-api/apache.log" } # probabaly ununsed
68+
oidcng_server: { program: "oidcngserver", target: "oidcng/oidcng.log" }
69+
oidcng_json: { program: "oicdngjson", target: "oidcng/oidcngjson.log" }
70+
oidc_play_server: { program: "oidcplaygroundserver", target: "oidc-playground/oidc-playground.log" }
71+
oidc_play_gui: { program: "oidcplaygroundgui", target: "oidc-playground/oidc-playground-apache.log" }
72+
manage_server: { program: "manageserver", target: "manage/manage.log" }
73+
manage_gui: { program: "managegui", target: "manage/apache.log" }
74+
aa_server: { program: "aaserver", target: "aa/aa.log" }
75+
aa_gui: { program: "aagui", target: "aa/apache.log" }
76+
aa_link: { program: "aalink", target: "aa/apache.log" }
77+
pdp: { program: "pdp", target: "pdp/pdp.log" }
78+
voot: { program: "vootserver", target: "voot/voot.log" }
79+
eduid_server: { program: "myconextserver", target: "eduid/myconext.log" }
80+
eduid_json: { program: "myconextjson", target: "eduid/myconextjson.log" }
81+
eduid_gui: { program: "myconextgui", target: "eduid/myconext-apache.log" }
82+
eduid_account: { program: "accountgui", target: "eduid/account-apache.log" }
83+
eduid_servicedesk: { program: "servicedeskgui", target: "eduid/servicedesk-apache.log" }
84+
invite_client: { program: "inviteclient", target: "invite/inviteclient.log" }
85+
invite_welcome: { program: "invitewelcome", target: "invite/invitewelcome.log" }
86+
invite_server: { program: "inviteserver", target: "invite/inviteserver.log" }
87+
invite_json: { program: "invitejson", target: "invite/invitejson.log" }
88+
invite_provmock: { program: "inviteprovisioningmock", target: "invite/inviteprovisioningmock.log" }
89+
teams_server: { program: "teamsserver", target: "teams/teams.log" }
90+
teams_gui: { program: "teamsgui", target: "teams/apache.log" }
91+
profile: { program: "profile", startwith: "{",
92+
target: "profile/profile.log" }
93+
profile_apache: { program: "profile", target: "profile/apache.log" }
94+
spdashboard: { program: "spdashboard", startwith: "spdashboard",
95+
target: "spdashboard/spdashboard.log" }
96+
spdashboard_apache: { program: "spdashboard", target: "spdashboard/apache.log" }
97+
dashboard_server: { program: "dashboardserver", target: "dashboard/dashboard.log" }
98+
dashboard_gui: { program: "dashboardgui", target: "dashboard/apache.log" }
99+
static: { program: "Apache-STATIC", target: "static/apache.log" }
100+
metadata: { program: "Apache-METADATA", target: "metadata/apache.log" }

‎roles/rsyslog/templates/sc_ruleset.conf.j2‎

Lines changed: 21 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,30 @@
1+
global({{ rsyslog_dir_file_modes }})
2+
13
$RuleSet {{ item.name }}
24
{% if item.name != "mgnt_sc" %}
3-
if $programname == "engineblock" and $msg startswith " engine" then { action(type="omfile" DynaFile="apache-eb-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
4-
if $programname == "engineblock" and $msg startswith "engine" then { action(type="omfile" DynaFile="apache-eb-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
5-
if $programname == "engineblock" and $msg contains '{"channel":"authentication"' then { action(type="omfile" DynaFile="ebauth-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
6-
:programname, isequal, "engineblock" { action(type="omfile" DynaFile="eblog-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
7-
:programname, isequal, "EBLOG" { action(type="omfile" DynaFile="eblog-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
8-
:programname, isequal, "Apache-EB" { action(type="omfile" DynaFile="apache-eb-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
9-
:programname, isequal, "EBAUTH" { action(type="omfile" DynaFile="ebauth-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
10-
:programname, isequal, "haproxy" { action(type="omfile" DynaFile="haproxy-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
11-
:programname, isequal, "aaserver" { action(type="omfile" DynaFile="aa-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
12-
:programname, isequal, "aagui" { action(type="omfile" DynaFile="apache-aa-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
13-
:programname, isequal, "aalink" { action(type="omfile" DynaFile="apache-aa-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
14-
:programname, isequal, "dashboardgui" { action(type="omfile" DynaFile="apache-dashboard-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
15-
:programname, isequal, "dashboardserver" { action(type="omfile" DynaFile="dashboard-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
16-
:programname, isequal, "Apache-EBAPI" { action(type="omfile" DynaFile="apache-eb-api-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
17-
:programname, isequal, "manageserver" { action(type="omfile" DynaFile="manage-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
18-
:programname, isequal, "managegui" { action(type="omfile" DynaFile="apache-manage-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
19-
:programname, isequal, "pdp" { action(type="omfile" DynaFile="pdp-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
20-
if $programname == "profile" and $msg startswith "{" then { action(type="omfile" DynaFile="profile-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
21-
:programname, isequal, "profile" { action(type="omfile" DynaFile="apache-profile-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
22-
:programname, isequal, "teamsserver" { action(type="omfile" DynaFile="teams-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
23-
:programname, isequal, "teamsgui" { action(type="omfile" DynaFile="apache-teams-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
24-
:programname, isequal, "vootserver" { action(type="omfile" DynaFile="voot-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
25-
:programname, isequal, "mariadbd" { action(type="omfile" DynaFile="galera-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
26-
:programname, isequal, "garb-systemd" { action(type="omfile" DynaFile="haproxy-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
27-
:programname, isequal, "Keepalived_vrrp" { action(type="omfile" DynaFile="keepalived-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
28-
:programname, startswith, "mongo" { action(type="omfile" DynaFile="mongo-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
29-
:programname, isequal, "Apache-STATIC" { action(type="omfile" DynaFile="apache-static-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
30-
:programname, isequal, "Apache-METADATA" { action(type="omfile" DynaFile="apache-metadata-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
31-
:programname, isequal, "oidcngserver" { action(type="omfile" DynaFile="oidcng-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
32-
:programname, isequal, "oidcngjson" { action(type="omfile" DynaFile="oidcngjson-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
33-
:programname, isequal, "oidcplaygroundserver" { action(type="omfile" DynaFile="oidc-playground-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
34-
:programname, isequal, "oidcplaygroundgui" { action(type="omfile" DynaFile="apache-oidcplayground-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
35-
:programname, isequal, "myconextserver" { action(type="omfile" DynaFile="myconext-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
36-
:programname, isequal, "myconextjson" { action(type="omfile" DynaFile="myconextjson-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
37-
:programname, isequal, "myconextgui" { action(type="omfile" DynaFile="apache-myconext-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
38-
:programname, isequal, "accountgui" { action(type="omfile" DynaFile="apache-account-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
39-
:programname, isequal, "servicedeskgui" { action(type="omfile" DynaFile="apache-servicedesk-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
40-
:programname, startswith, "inviteclient" { action(type="omfile" DynaFile="inviteclient-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
41-
:programname, startswith, "invitewelcome" { action(type="omfile" DynaFile="invitewelcome-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
42-
:programname, startswith, "inviteserver" { action(type="omfile" DynaFile="inviteserver-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
43-
:programname, isequal, "invitejson" { action(type="omfile" DynaFile="invitejson-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
44-
:programname, startswith, "inviteprovisioningmock" { action(type="omfile" DynaFile="inviteprovisioningmock-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
45-
:programname, startswith, "loadbalancer" { action(type="omfile" DynaFile="loadbalancer-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
465

47-
if $programname == "gateway" and $msg contains '{"message":"Second Factor Authenticated"' then { action(type="omfile" DynaFile="stepup-authentication-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
48-
if $programname == "gateway" and $msg contains '{"message":"Intrinsic Loa Requested"' then { action(type="omfile" DynaFile="stepup-authentication-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
6+
{% for app, config in rsyslog_central_apps.items() %}
7+
if $programname == "{{ config.program }}"
8+
{%- if 'contains' in config %} and $msg contains {{ config.contains }} {% endif -%}
9+
{%- if 'startswith' in config %} and $msg startswith {{ config.startswith }} {% endif %}
10+
then { action(type="omfile" DynaFile="{{ app }}-{{ item.name }}") stop }}
11+
{% endfor %}
4912

5013
{% for stepupapp in stepupapps %}
51-
:programname, isequal, "stepup-{{ stepupapp }}" { action(type="omfile" DynaFile="stepup-{{ stepupapp }}-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
52-
if $programname == "{{ stepupapp }}" and $msg startswith "{{ stepupapp }}" then { action(type="omfile" DynaFile="apache-{{ stepupapp }}-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
53-
:programname, isequal, "{{ stepupapp }}" { action(type="omfile" DynaFile="stepup-{{ stepupapp }}-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
54-
:programname, isequal, "Apache-{{ stepupapp }}" { action(type="omfile" DynaFile="apache-{{ stepupapp }}-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
14+
if $programname == "stepup-{{ stepupapp }}" then { action(type="omfile" DynaFile="stepup-{{ stepupapp }}-{{item.name }}") stop }
15+
if $programname == "{{ stepupapp }}" and $msg startswith "{{ stepupapp }}" then { action(type="omfile" DynaFile="apache-{{ stepupapp }}-{{item.name }}") stop }
16+
if $programname == "{{ stepupapp }}" then { action(type="omfile" DynaFile="stepup-{{ stepupapp }}-{{item.name }}") stop }
17+
if $programname == "Apache-{{ stepupapp }}" then { action(type="omfile" DynaFile="apache-{{ stepupapp }}-{{item.name }}") stop }
5518
{% endfor %}
56-
:programname, isequal, "Apache-azuremfa" { action(type="omfile" DynaFile="apache-azure-mfa-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
57-
if $programname == "spdashboard" and $msg startswith "spdashboard" then { action(type="omfile" DynaFile="apache-spdashboard-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
58-
:programname, isequal, "spdashboard" { action(type="omfile" DynaFile="spdashboard-{{item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
19+
if $programname == "Apache-azuremfa" then { action(type="omfile" DynaFile="apache-azure-mfa-{{ item.name }}") stop }
20+
5921

60-
:programname, isequal, "stepup-authentication" { action(type="omfile" DynaFile="stepup-authentication-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
6122
{% endif %}
62-
:programname, isequal, "audispd" { action(type="omfile" DynaFile="auditd-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
63-
:programname, isequal, "audit" { action(type="omfile" DynaFile="auditd-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
64-
:programname, isequal, "audisp-syslog" { action(type="omfile" DynaFile="auditd-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
65-
:programname, isequal, "-bash" { action(type="omfile" DynaFile="bash-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
66-
:syslogfacility-text, isequal, "authpriv" { action(type="omfile" dynafile="secure-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
67-
:msg, contains, "-- MARK --" { action(type="omfile" DynaFile="MARK-{{ item.name }}" {{ rsyslog_dir_file_modes }} ) stop }
23+
if $programname == "audispd" then { action(type="omfile" DynaFile="auditd-{{ item.name }}") stop }
24+
if $programname == "audit" then { action(type="omfile" DynaFile="auditd-{{ item.name }}") stop }
25+
if $programname == "audisp-syslog" then { action(type="omfile" DynaFile="auditd-{{ item.name }}") stop }
26+
if $programname == "-bash" then { action(type="omfile" DynaFile="bash-{{ item.name }}") stop }
27+
if $programname == "authpriv" then { action(type="omfile" dynafile="secure-{{ item.name }}") stop }
28+
if $msg contains "-- MARK --" then { action(type="omfile" DynaFile="MARK-{{ item.name }}") stop }
29+
6830
*.* ?hostleft-{{ item.name }}

0 commit comments

Comments
 (0)