Puppet Class: simp_rsyslog
- Defined in:
- manifests/init.pp
Overview
Set up Rsyslog on your system
By default, this only sets up the system as a local Rsyslog server with no outside connectivity allowed.
If you set the $is_server
parameter, you will set this system
up as a log server able to receive input from external systems. Restriction
of this input is controlled by the ::rsyslog
class and the
parameters there should be evaluated if you do not agree with the defaults.
If you include the ::simp_rsyslog::forward
class, your system
will send its security relevant logs (by default) to the specified
$log_servers
and $failover_log_servers
.
WARNING
Be VERY careful when setting your
log_servers
andfailover_log_servers
Arrays!There is no foolproof way to detect if you are setting your local log server as part of the Array. If you do this, you may end up with infinite log loops that fill your log server's disk space within minutes.
WARNING
This module is a component of the System Integrity Management Platform, a managed security compliance framework built on Puppet.
This module is a SIMP Profile and is not meant to be used outside of the SIMP ecosystem. It may work, but may also require a large number of additional SIMP components to function properly.
105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 |
# File 'manifests/init.pp', line 105
class simp_rsyslog (
Boolean $is_server = false,
Boolean $forward_logs = false,
Array[String] $log_servers = simplib::lookup('simp_options::syslog::log_servers', { 'default_value' => [] }),
Array[String] $failover_log_servers = simplib::lookup('simp_options::syslog::failover_log_servers', { 'default_value' => [] }),
Hash[String, Array[String]] $log_collection = {},
Hash[
Enum[
'programs',
'facilities',
'msg_starts',
'msg_regex'
],
Array[String]
] $default_logs = {
'programs' => [ 'sudo', 'sudosh', 'yum', 'auditd', 'audit', 'systemd', 'crond' ],
'facilities' => [ 'cron.*', 'authpriv.*', 'local6.*', 'local7.warn', '*.emerg'],
'msg_starts' => ['IPT:'],
'msg_regex' => []
},
Boolean $log_openldap = false,
Boolean $log_local = true,
Stdlib::Absolutepath $local_target = '/var/log/secure',
Boolean $collect_everything = false
) {
if $log_openldap {
$_openldap_logs = {
'programs' => [ 'slapd' ],
'facilities' => [ 'local4' ]
}
}
else {
$_openldap_logs = {}
}
if $collect_everything {
$security_relevant_logs = "prifilt('*.*')"
}
elsif !empty($log_collection) {
$security_relevant_logs = simp_rsyslog::format_options(
deep_merge($default_logs, $_openldap_logs, $log_collection)
)
}
else {
$security_relevant_logs = simp_rsyslog::format_options(
deep_merge($default_logs, $_openldap_logs)
)
}
include '::rsyslog'
include '::logrotate'
if $log_local {
contain '::simp_rsyslog::local'
}
if $forward_logs {
contain '::simp_rsyslog::forward'
}
if $is_server {
contain '::simp_rsyslog::server'
}
}
|