RSyslog Deployment Guide#

The following instructions are for deploying RSyslog using TLS.

Prerequisites#

This guide is written for a Red Hat Enterprise Linux 8 based operating system which is operating within a cluster of systems and the following are the prerequisites:

References#

These instructions were written for RSyslog 8.x.x

Instructions are based on the following documentation:
https://docs.graylog.org/docs/syslog

Deployment Scripts#

Note

An example bash script of the instructions has been provided: deploy-rsyslog.sh

Deployment Steps#

Note

Instructions assume execution using the root account.

  1. Install dependencies:

dnf -y install rsyslog

  1. Create rsyslog configuration file:

Important

Replace the target and port with the value of your network.

cat > /etc/rsyslog.d/graylog.conf <<EOF
*.* action(
   Action.resumeInterval="10"
   RebindInterval="10000"
   Queue.Size="100000"
   Queue.DiscardMark="97500"
   Queue.HighWaterMark="80000"
   Queue.Type="LinkedList"
   Queue.FileName="rsyslogqueue"
   Queue.CheckpointInterval="100"
   Queue.MaxDiskSpace="2g"
   Action.ResumeRetryCount="-1"
   Queue.SaveOnShutdown="on"
   Queue.TimeoutEnqueue="10"
   Queue.DiscardSeverity="0"
   type="omfwd"
   target="graylog.engwsc.example.com"
   protocol="tcp"
   port="6514"
   template="RSYSLOG_SyslogProtocol23Format"
   StreamDriver="gtls"
   StreamDriverMode="1"
   StreamDriverAuthMode="anon"
)
EOF

  1. Start/Restart Rsyslog service:

systemctl enable rsyslog
systemctl restart rsyslog