25.6. Configuring rsyslog on a Logging Server

Procedure 25.5. Configure SELinux to Permit rsyslog Traffic on a Port

1. ~]# semanage port -a -t syslogd_port_t -p tcp 10514

2. Review the SELinux ports by entering the following command:

   ~]# semanage port -l | grep syslog

3. If the new port was already configured in /etc/rsyslog.conf, restart rsyslog now for the change to take effect:

   ~]# service rsyslog restart

4. Verify which ports rsyslog is now listening to:

   ~]# netstat -tnlp | grep rsyslog
   tcp        0      0 0.0.0.0:10514           0.0.0.0:*   LISTEN      2528/rsyslogd
   tcp        0      0 :::10514                :::*        LISTEN      2528/rsyslogd

Procedure 25.6. Configuring The iptables Firewall

1. Open the /etc/sysconfig/iptables file in a text editor.
2. Add an INPUT rule allowing TCP traffic on port 10514 to the file. The new rule must appear before any INPUT rules that REJECT traffic.

   -A INPUT -m state --state NEW -m tcp -p tcp --dport 10514 -j ACCEPT

3. Save the changes to the /etc/sysconfig/iptables file.
4. Restart the iptables service for the firewall changes to take effect.

   ~]# service iptables restart

Procedure 25.7. Configuring rsyslog to Receive and Sort Remote Log Messages

1. Open the /etc/rsyslog.conf file in a text editor and proceed as follows:
   1. Add these lines below the modules section but above the Provides UDP syslog reception section:

      # Define templates before the rules that use them
      
      ### Per-Host Templates for Remote Systems ###
      $template TmplAuthpriv, "/var/log/remote/auth/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log"
      $template TmplMsg, "/var/log/remote/msg/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log"

   2. Replace the default Provides TCP syslog reception section with the following:

      # Provides TCP syslog reception
      $ModLoad imtcp
      # Adding this ruleset to process remote messages
      $RuleSet remote1
      authpriv.*   ?TmplAuthpriv
      *.info;mail.none;authpriv.none;cron.none   ?TmplMsg
      $RuleSet RSYSLOG_DefaultRuleset   #End the rule set by switching back to the default rule set
      $InputTCPServerBindRuleset remote1  #Define a new input and bind it to the "remote1" rule set
      $InputTCPServerRun 10514

   Save the changes to the /etc/rsyslog.conf file.
2. The rsyslog service must be running on both the logging server and the systems attempting to log to it.
   1. Use the service command to start the rsyslog service.

      ~]# service rsyslog start

   2. To ensure the rsyslog service starts automatically in future, enter the following command as root:

      ~]# chkconfig rsyslog on