15.4. Using the logging RHEL system roles with RELP

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure client-side of the remote logging solution by using RELP
     hosts: managed-node-01.example.com
     tasks:
       - name: Deploy basic input and RELP output
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.logging
         vars:
           logging_inputs:
             - name: basic_input
               type: basics
           logging_outputs:
             - name: relp_client
               type: relp
               target: logging.server.com
               port: 20514
               tls: true
               ca_cert: /etc/pki/tls/certs/ca.pem
               cert: /etc/pki/tls/certs/client-cert.pem
               private_key: /etc/pki/tls/private/client-key.pem
               pki_authmode: name
               permitted_servers:
                 - '*.server.example.com'
           logging_flows:
             - name: example_flow
               inputs: [basic_input]
               outputs: [relp_client]

   The settings specified in the example playbook include the following:

   target

   This is a required parameter that specifies the host name where the remote logging system is running.

   port

   Port number the remote logging system is listening.

   tls

   Ensures secure transfer of logs over the network. If you do not want a secure wrapper you can set the tls variable to false. By default tls parameter is set to true while working with RELP and requires key/certificates and triplets {ca_cert, cert, private_key} and/or {ca_cert_src, cert_src, private_key_src}.

   • If the {ca_cert_src, cert_src, private_key_src} triplet is set, the default locations /etc/pki/tls/certs and /etc/pki/tls/private are used as the destination on the managed node to transfer files from control node. In this case, the file names are identical to the original ones in the triplet
   • If the {ca_cert, cert, private_key} triplet is set, files are expected to be on the default path before the logging configuration.
   • If both triplets are set, files are transferred from the local path on the control node to the specific path of the managed node.

   ca_cert

   Represents the path to CA certificate. The default path is /etc/pki/tls/certs/ca.pem and the file name is set by the user.

   cert

   Represents the path to certificate. The default path is /etc/pki/tls/certs/server-cert.pem and the file name is set by the user.

   private_key

   Represents the path to the private key. The default path is /etc/pki/tls/private/server-key.pem and the file name is set by the user.

   ca_cert_src

   Represents local CA certificate file path which is copied to the managed node. If ca_cert is specified, it is copied to the location.

   cert_src

   Represents the local certificate file path which is copied to the managed node. If cert is specified, it is copied to the location.

   private_key_src

   Represents the local key file path which is copied to the managed node. If private_key is specified, it is copied to the location.

   pki_authmode

   Accepts the authentication mode as name or fingerprint.

   permitted_servers

   List of servers that will be allowed by the logging client to connect and send logs over TLS.

   inputs

   List of logging input dictionary.

   outputs

   List of logging output dictionary.

   For details about the role variables and more information about rsyslog, see the /usr/share/ansible/roles/rhel-system-roles.logging/README.md file and the rsyslog.conf(5) and syslog(3) manual pages on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure server-side of the remote logging solution by using RELP
     hosts: managed-node-01.example.com
     tasks:
       - name: Deploying remote input and remote_files output
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.logging
         vars:
           logging_inputs:
             - name: relp_server
               type: relp
               port: 20514
               tls: true
               ca_cert: /etc/pki/tls/certs/ca.pem
               cert: /etc/pki/tls/certs/server-cert.pem
               private_key: /etc/pki/tls/private/server-key.pem
               pki_authmode: name
               permitted_clients:
                 - '*client.example.com'
           logging_outputs:
             - name: remote_files_output
               type: remote_files
           logging_flows:
             - name: example_flow
               inputs: [relp_server]
               outputs: [remote_files_output]

   The settings specified in the example playbook include the following:

   port

   Port number the remote logging system is listening.

   tls

   Ensures secure transfer of logs over the network. If you do not want a secure wrapper you can set the tls variable to false. By default tls parameter is set to true while working with RELP and requires key/certificates and triplets {ca_cert, cert, private_key} and/or {ca_cert_src, cert_src, private_key_src}.

   • If the {ca_cert_src, cert_src, private_key_src} triplet is set, the default locations /etc/pki/tls/certs and /etc/pki/tls/private are used as the destination on the managed node to transfer files from control node. In this case, the file names are identical to the original ones in the triplet
   • If the {ca_cert, cert, private_key} triplet is set, files are expected to be on the default path before the logging configuration.
   • If both triplets are set, files are transferred from the local path on the control node to the specific path of the managed node.

   ca_cert

   Represents the path to CA certificate. The default path is /etc/pki/tls/certs/ca.pem and the file name is set by the user.

   cert

   Represents the path to the certificate. The default path is /etc/pki/tls/certs/server-cert.pem and the file name is set by the user.

   private_key

   Represents the path to the private key. The default path is /etc/pki/tls/private/server-key.pem and the file name is set by the user.

   ca_cert_src

   Represents local CA certificate file path which is copied to the managed node. If ca_cert is specified, it is copied to the location.

   cert_src

   Represents the local certificate file path which is copied to the managed node. If cert is specified, it is copied to the location.

   private_key_src

   Represents the local key file path which is copied to the managed node. If private_key is specified, it is copied to the location.

   pki_authmode

   Accepts the authentication mode as name or fingerprint.

   permitted_clients

   List of clients that will be allowed by the logging server to connect and send logs over TLS.

   inputs

   List of logging input dictionary.

   outputs

   List of logging output dictionary.

   For details about the role variables and more information about rsyslog, see the /usr/share/ansible/roles/rhel-system-roles.logging/README.md file and the rsyslog.conf(5) and syslog(3) manual pages on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml