How To Configure Syslog on Rocky Linux 9

Syslog is a crucial component of any Linux system, providing centralized logging capabilities that are essential for system administrators and developers alike. In this comprehensive guide, we’ll walk you through the process of configuring Syslog on Rocky Linux 9, ensuring you have a robust logging solution for your infrastructure.

Understanding Syslog in Rocky Linux 9

Rocky Linux 9, like its predecessor CentOS, uses Rsyslog as its default syslog daemon. Rsyslog is an advanced version of the traditional syslog, offering enhanced features such as TCP/UDP protocols for remote logging, database support, and filtering capabilities.

Components of Rsyslog

Rsyslog consists of several key components:

• Input modules: Collect log messages from various sources
• Parser modules: Interpret and structure the incoming log data
• Output modules: Direct processed logs to their final destinations
• Core engine: Manages the flow of log messages through the system

Prerequisites for Syslog Configuration

Before we dive into the configuration process, ensure your Rocky Linux 9 system meets the following requirements:

• A fresh installation of Rocky Linux 9
• Root or sudo access to the system
• Basic knowledge of Linux command-line operations
• Stable network connection (for remote logging setup)

Installation and Basic Setup

Rocky Linux 9 comes with Rsyslog pre-installed. However, it’s always a good practice to ensure you have the latest version:

sudo dnf update
sudo dnf install rsyslog

After installation, start and enable the Rsyslog service:

sudo systemctl start rsyslog
sudo systemctl enable rsyslog
sudo systemctl status rsyslog

You should see output indicating that the service is active and running.

Basic Configuration of Rsyslog

The main configuration file for Rsyslog is located at /etc/rsyslog.conf. Let’s explore some essential settings:

Modifying the Main Configuration File

Open the configuration file with your preferred text editor:

sudo nano /etc/rsyslog.conf

Setting Up Log Rotation

Log rotation is crucial for managing disk space. Rocky Linux 9 uses logrotate for this purpose. Edit the logrotate configuration:

sudo nano /etc/logrotate.conf

Add or modify entries to suit your needs. For example:

/var/log/messages {
    weekly
    rotate 4
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
        /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
    endscript
}

This configuration rotates logs weekly, keeps four weeks of logs, and compresses old logs.

Advanced Configuration Options

For more complex setups, Rocky Linux 9’s Rsyslog offers advanced configuration options:

Remote Logging Setup

To enable remote logging, uncomment or add these lines in /etc/rsyslog.conf:

# Provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# Provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

Configuring Secure Remote Logging with TLS

For enhanced security, configure TLS encryption:

1. Generate certificates:

sudo openssl req -newkey rsa:2048 -x509 -days 3650 -nodes -keyout /etc/rsyslog.d/cert.key -out /etc/rsyslog.d/cert.crt

2. Edit the Rsyslog configuration:

# Make gtls driver the default
$DefaultNetstreamDriver gtls

# Certificate files
$DefaultNetstreamDriverCAFile /etc/rsyslog.d/cert.crt
$DefaultNetstreamDriverCertFile /etc/rsyslog.d/cert.crt
$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/cert.key

# Add GTLS driver
$ModLoad imtcp

# Run TCP server on port 10514 for TLS-encrypted connections
$InputTCPServerStreamDriverMode 1
$InputTCPServerStreamDriverAuthMode anon
$InputTCPServerRun 10514

Security Considerations

Securing your Syslog setup is crucial for maintaining the integrity of your logging system:

SELinux Configuration

Rocky Linux 9 uses SELinux by default. Ensure Rsyslog can function properly:

sudo setsebool -P nis_enabled 1

Firewall Rules

If you’re using remote logging, open the necessary ports:

sudo firewall-cmd --permanent --add-port=514/udp
sudo firewall-cmd --permanent --add-port=514/tcp
sudo firewall-cmd --reload

Integration with Journald

Rocky Linux 9 uses systemd, which includes journald. To integrate Rsyslog with journald:

1. Edit /etc/rsyslog.conf
2. Add or uncomment:

module(load="imjournal")

This allows Rsyslog to read logs from the systemd journal.

Remote Logging Configuration

To set up a centralized logging server:

Server Configuration

On the server, edit /etc/rsyslog.conf:

# Provide TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

# Set the file format
$template RemoteLogs,"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?RemoteLogs

Client Configuration

On each client, add to /etc/rsyslog.conf:

*.* @@server_ip:514

Replace server_ip with your logging server’s IP address.

Troubleshooting Common Issues

When configuring Syslog on Rocky Linux 9, you might encounter some issues. Here are common problems and their solutions:

Rsyslog Service Not Starting

If the Rsyslog service fails to start, check the system logs:

sudo journalctl -u rsyslog

Look for error messages that might indicate configuration problems or permission issues.

Logs Not Being Received

If remote logs aren’t being received:

1. Check firewall settings on both server and client.
2. Verify network connectivity.
3. Ensure the correct ports are being used.

SELinux Blocking Rsyslog

If SELinux is preventing Rsyslog from functioning correctly:

sudo ausearch -c 'rsyslogd' --raw | audit2allow -M my-rsyslogd
sudo semodule -i my-rsyslogd.pp

This creates and installs a custom SELinux policy for Rsyslog.

Best Practices and Optimization

To ensure optimal performance of your Syslog setup on Rocky Linux 9:

Regular Maintenance

1. Monitor log sizes and adjust rotation policies as needed.
2. Regularly review and prune unnecessary log entries.
3. Keep Rsyslog and related packages updated.

Performance Tuning

For high-volume logging environments:

1. Use TCP for more reliable transmission.
2. Implement log buffering to handle traffic spikes.
3. Consider using multiple Rsyslog instances for load balancing.

Congratulations! You have successfully setup Rsyslog. Thanks for using this tutorial to configure the Rsyslog on Rocky Linux 9 system. For additional help or useful information, we recommend you check the official Rsyslog website.