Puppet Class: simp_rsyslog::server

Defined in:
manifests/server.pp

Overview

NOTE: THIS IS A PRIVATE CLASS

This class provides a general purpose log server suitable for centralized logging.

It is highly recommended that you look to use the Logstash module at this point.

The following must be set in Hiera for this class to work properly:

rsyslog::global::tls_tcpserver: true

The following are optional for legacy, unencrypted connections.
rsyslog::global::tcpserver: true
rsyslog::global::udpserver: true
rsyslog::global::udpServerAddress: '0.0.0.0'

Loose standard for the rules that will be created:

  • 10_default = specific rules to be caught early (ex. matching on programname + error + etc.)

  • 11_default = specific rules that have a corresponding “0_default” entry but have a less-specific rule than “0_default” (ex. matching on programname)

  • 17_default = catch all for security relevant logs that weren't caught by previous rules

  • 19_default = anything else gets sent to messages

  • 30_default = stop processing (if appropriate), don't go past this


Parameters:

  • server_conf (Optional[String]) (defaults to: undef)

    The full configuration to use

    • Adds the contained rsyslog configuration to the system instead of the default from this module. This allows you complete freedom in specifying your log server ruleset if you do not like the one that is provided. There will be no sanity checking of this string!

  • process_sudosh_rules (Boolean) (defaults to: true)

    Enable processing of sudosh rules

  • process_httpd_rules (Boolean) (defaults to: true)

    Enable processing of httpd rules

  • process_dhcpd_rules (Boolean) (defaults to: true)

    Enable processing of dhcpd rules

  • process_puppet_agent_rules (Boolean) (defaults to: true)

    Enable processing of puppet agent rules

  • process_puppetserver_rules (Boolean) (defaults to: true)

    Enable processing of puppetserver rules

  • process_auditd_rules (Boolean) (defaults to: true)

    Enable processing of auditd rules

  • process_slapd_rules (Boolean) (defaults to: true)

    Enable processing of OpenLDAP Server rules

  • process_kern_rules (Boolean) (defaults to: true)

    Enable processing of kern.* rules

  • process_iptables_rules (Boolean) (defaults to: true)

    Enable processing of messages starting with IPT:

  • process_security_relevant_logs (Boolean) (defaults to: true)

    Enable processing of the ::simp_rsyslog::security_relevant_logs

  • process_message_rules (Boolean) (defaults to: true)

    Enable the default /var/log/message traditional processing

  • process_mail_rules (Boolean) (defaults to: true)

    Enable processing of mail.* rules

  • process_cron_rules (Boolean) (defaults to: true)

    Enable processing of cron.* rules

  • process_emerg_rules (Boolean) (defaults to: true)

    Enable processing of *.emerg rules

  • process_spool_rules (Boolean) (defaults to: true)

    Enable processing of spool.* rules

  • process_boot_rules (Boolean) (defaults to: true)

    Enable processing of local7.* rules

  • enable_catchall (Boolean) (defaults to: true)

    Add anything missed by other rules to a catchall.log file

  • stop_processing (Boolean) (defaults to: true)

    Do not continue processing additional Rsyslog rules after the logs have been sent to the remote server.

    • You will probably want to keep this set so that your local system logs are not filled with material from other hosts.

  • add_logrotate_rule (Boolean) (defaults to: true)

    Add a logrotate rule for the logs that are collected by these server rules

    • This will not be applied if you are not using the inbuilt rules since there is no way to know what you are doing.

  • rotate_period (Enum['daily','weekly','monthly','yearly']) (defaults to: 'weekly')

    How often to rotate the local logs

    • Has no effect if add_logrotate_rule is false

  • rotate_preserve (Integer) (defaults to: 12)

    How many rotated logs to preserve

    • 3 months by default

    • Has no effect if add_logrotate_rule is false

  • rotate_size (Optional[Integer]) (defaults to: undef)

    The maximum size of a log file

    • $rotate_period will be ignored if this is specified

    • Has no effect if add_logrotate_rule is false

Author:



127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
# File 'manifests/server.pp', line 127

class simp_rsyslog::server(
  Optional[String]                          $server_conf                    = undef,
  Boolean                                   $process_sudosh_rules           = true,
  Boolean                                   $process_httpd_rules            = true,
  Boolean                                   $process_dhcpd_rules            = true,
  Boolean                                   $process_puppet_agent_rules     = true,
  Boolean                                   $process_puppetserver_rules     = true,
  Boolean                                   $process_auditd_rules           = true,
  Boolean                                   $process_slapd_rules            = true,
  Boolean                                   $process_kern_rules             = true,
  Boolean                                   $process_iptables_rules         = true,
  Boolean                                   $process_security_relevant_logs = true,
  Boolean                                   $process_message_rules          = true,
  Boolean                                   $process_mail_rules             = true,
  Boolean                                   $process_cron_rules             = true,
  Boolean                                   $process_emerg_rules            = true,
  Boolean                                   $process_spool_rules            = true,
  Boolean                                   $process_boot_rules             = true,
  Boolean                                   $enable_catchall                = true,
  Boolean                                   $stop_processing                = true,
  Boolean                                   $add_logrotate_rule             = true,
  Enum['daily','weekly','monthly','yearly'] $rotate_period                  = 'weekly',
  Integer                                   $rotate_preserve                = 12,
  Optional[Integer]                         $rotate_size                    = undef
) {
  include '::rsyslog'
  include '::rsyslog::server'

  assert_private()

  if $server_conf {
    rsyslog::rule::local { '0_default':
      rule            => $server_conf,
      stop_processing => $stop_processing
    }
  }
  else {
    $file_base = '/var/log/hosts/%HOSTNAME%'

    # Up front because they are the fastest to process
    if $process_boot_rules {
      rsyslog::rule::local { '10_00_default_boot':
        rule            => 'prifilt(\'local7.*\')',
        dyna_file       => "${file_base}/boot.log",
        stop_processing => $stop_processing
      }
    }
    if $process_kern_rules {
      rsyslog::rule::local { '10_00_default_kern':
        rule            => 'prifilt(\'kern.*\')',
        dyna_file       => "${file_base}/kernel.log",
        stop_processing => $stop_processing
      }
    }
    if $process_mail_rules {
      rsyslog::rule::local { '10_00_default_mail':
        rule            => 'prifilt(\'mail.*\')',
        dyna_file       => "${file_base}/mail.log",
        stop_processing => $stop_processing
      }
    }
    if $process_cron_rules {
      rsyslog::rule::local { '10_00_default_cron':
        rule            => 'prifilt(\'cron.*\')',
        dyna_file       => "${file_base}/cron.log",
        stop_processing => $stop_processing
      }
    }
    if $process_emerg_rules {
      rsyslog::rule::local { '10_00_default_emerg':
        rule            => 'prifilt(\'*.emerg\')',
        dyna_file       => "${file_base}/emergency.log",
        stop_processing => $stop_processing
      }
    }

    # Every other regular processing rule
    if $process_sudosh_rules {
      rsyslog::rule::local { '10_default_sudosh':
        rule            => '$programname == \'sudosh\'',
        dyna_file       => "${file_base}/sudosh.log",
        stop_processing => $stop_processing
      }
    }
    if $process_httpd_rules {
      rsyslog::rule::local { '10_default_httpd_error':
        rule            => 'prifilt(\'*.err\') and ($programname == \'httpd\')',
        dyna_file       => "${file_base}/httpd_error.log",
        stop_processing => $stop_processing
      }
      rsyslog::rule::local { '11_default_httpd':
        rule            => '$programname == \'httpd\'',
        dyna_file       => "${file_base}/httpd.log",
        stop_processing => $stop_processing
      }
    }
    if $process_dhcpd_rules {
      rsyslog::rule::local { '10_default_dhcpd':
        rule            => '$programname == \'dhcpd\'',
        dyna_file       => "${file_base}/dhcpd.log",
        stop_processing => $stop_processing
      }
    }
    if $process_puppet_agent_rules {
      rsyslog::rule::local { '10_default_puppet_agent_error':
        rule            => 'prifilt(\'*.err\') and ($programname == \'puppet\')',
        dyna_file       => "${file_base}/puppet_agent_error.log",
        stop_processing => $stop_processing
      }
      rsyslog::rule::local { '11_default_puppet_agent':
        rule            => '$programname == \'puppet\'',
        dyna_file       => "${file_base}/puppet_agent.log",
        stop_processing => $stop_processing
      }
    }
    if $process_puppetserver_rules {
      rsyslog::rule::local { '10_default_puppetserver_error':
        rule            => 'prifilt(\'*.err\') and ($programname == \'puppetserver\')',
        dyna_file       => "${file_base}/puppetserver_error.log",
        stop_processing => $stop_processing
      }
      rsyslog::rule::local { '11_default_puppetserver':
        rule            => '$programname == \'puppetserver\'',
        dyna_file       => "${file_base}/puppetserver.log",
        stop_processing => $stop_processing
      }
    }
    if $process_auditd_rules {
      rsyslog::rule::local { '10_default_audit':
        rule            => 'prifilt(\'local5.*\') or ($programname == \'audispd\') or ($syslogtag == \'tag_auditd_log:\')',
        dyna_file       => "${file_base}/auditd.log",
        stop_processing => $stop_processing
      }
    }
    if $process_slapd_rules {
      rsyslog::rule::local { '10_default_slapd_audit':
        rule            => '$programname == \'slapd_audit\'',
        dyna_file       => "${file_base}/slapd_audit.log",
        stop_processing => $stop_processing
      }
    }
    if $process_iptables_rules {
      rsyslog::rule::local { '10_default_iptables':
        rule            => 'prifilt(\'kern.*\') and ($msg startswith \'IPT:\')',
        dyna_file       => "${file_base}/iptables.log",
        stop_processing => $stop_processing
      }
    }
    if $process_spool_rules {
      rsyslog::rule::local { '10_default_spool':
        rule            => '($syslogfacility-text == \'uucp\') or (($syslogfacility-text == \'news\') and prifilt(\'*.crit\'))',
        dyna_file       => "${file_base}/spool.log",
        stop_processing => $stop_processing
      }
    }

    # Late processing items
    if $process_security_relevant_logs {
      rsyslog::rule::local { '17_default_security_relevant_logs':
        rule            => $::simp_rsyslog::security_relevant_logs,
        dyna_file       => "${file_base}/secure.log",
        stop_processing => $stop_processing
      }
    }
    if $process_message_rules {
      rsyslog::rule::local { '19_default_message':
        rule            => 'prifilt(\'*.info;mail.none;authpriv.none;cron.none;local6.none;local5.none\')',
        dyna_file       => "${file_base}/messages.log",
        stop_processing => $stop_processing
      }
    }

    # End of processing
    if $enable_catchall {
      rsyslog::rule::local { '30_default_catchall':
        rule            => 'prifilt(\'*.*\')',
        dyna_file       => "${file_base}/catchall.log",
        stop_processing => $stop_processing
      }
    }
    else {
      if $stop_processing {
        rsyslog::rule::local { '30_default_drop':
          rule            => 'prifilt(\'*.*\')',
          dyna_file       => '~',
          # We don't need this due to the line above
          stop_processing => false
        }
      }
    }

    if $add_logrotate_rule {
      include '::logrotate'

      $_restartcmd = 'systemd' in $facts['init_systems'] ? {
        true    => '/usr/sbin/systemctl restart rsyslog',
        default => '/usr/sbin/service rsyslog restart'
      }

      logrotate::rule { 'simp_rsyslog_server_profile':
        log_files     => [ "${file_base}/*/*.log" ],
        missingok     => true,
        size          => $rotate_size,
        rotate_period => $rotate_period,
        rotate        => $rotate_preserve,
        lastaction    => "${_restartcmd} > /dev/null 2>&1 || true"
      }
    }
  }
}