117 lines
3.4 KiB
Text
117 lines
3.4 KiB
Text
|
{{ ansible_managed | comment }}
|
||
|
|
|
||
|
|
{%
|
||
|
|
set output_modules = {
|
||
|
|
"relp": "omrelp",
|
||
|
|
"zeromq": "omczmq",
|
||
|
|
"udp": "omfwd",
|
||
|
|
"redis": "omhiredis",
|
||
|
|
}
|
||
|
|
%}
|
||
|
|
|
||
|
|
global(
|
||
|
|
workDirectory="/var/spool/rsyslog"
|
||
|
|
preserveFQDN="on"
|
||
|
|
)
|
||
|
|
|
||
|
|
# Collecte des journaux via /dev/log
|
||
|
|
module(load="imuxsock")
|
||
|
|
|
||
|
|
# Collection des journaux du noyau
|
||
|
|
module(load="imklog")
|
||
|
|
|
||
|
|
# Collecte des journaux de systemd-journald
|
||
|
|
module(load="imjournal")
|
||
|
|
|
||
|
|
# FIXME: utile pour systemd-journald ?
|
||
|
|
# Traitement des journaux CEE
|
||
|
|
module(load="mmjsonparse")
|
||
|
|
|
||
|
|
{% if rsyslog_outputs is defined %}
|
||
|
|
# Chargement des modules d'export des logs
|
||
|
|
{%
|
||
|
|
for module in rsyslog_outputs
|
||
|
|
| map(attribute="proto")
|
||
|
|
| map("extract", output_modules)
|
||
|
|
| list
|
||
|
|
| unique
|
||
|
|
%}
|
||
|
|
module(load="{{ module }}")
|
||
|
|
{% endfor %}
|
||
|
|
{% endif %}
|
||
|
|
|
||
|
|
# FIXME: Attention, il faut voir si rsyslog arrive bien à créer
|
||
|
|
# les fichiers de plusieurs jours (le 1er est peut-être crée avant
|
||
|
|
# de dropper les privilèges, mais les suivants je pense pas).
|
||
|
|
module(
|
||
|
|
load="builtin:omfile"
|
||
|
|
# Format avec dates précises
|
||
|
|
template="RSYSLOG_FileFormat"
|
||
|
|
fileOwner="root"
|
||
|
|
fileGroup="adm"
|
||
|
|
fileCreateMode="0640"
|
||
|
|
dirCreateMode="0755"
|
||
|
|
)
|
||
|
|
|
||
|
|
template(name="templateJson" type="list" option.jsonf="on") {
|
||
|
|
property(outname="hostname_reported" name="hostname" format="jsonf")
|
||
|
|
property(outname="src" name="fromhost-ip" format="jsonf")
|
||
|
|
property(outname="facility" name="syslogfacility-text" format="jsonf")
|
||
|
|
property(outname="program" name="programname" format="jsonf")
|
||
|
|
property(outname="pid" name="procid" format="jsonf")
|
||
|
|
property(outname="time_reported" name="timereported" format="jsonf" dateformat="rfc3339")
|
||
|
|
property(outname="time_generated" name="timegenerated" format="jsonf" dateformat="rfc3339")
|
||
|
|
property(outname="message" name="msg" format="jsonf")
|
||
|
|
}
|
||
|
|
|
||
|
|
ruleset(name="sendLogsToDisk") {
|
||
|
|
auth,authpriv.* action(type="omfile" file="/var/log/auth.log")
|
||
|
|
mail.* action(type="omfile" file="/var/log/mail.log" sync="off")
|
||
|
|
kern.* action(type="omfile" file="/var/log/kern.log")
|
||
|
|
*.*;auth,authpriv.none action(type="omfile" file="/var/log/syslog.log" sync="off")
|
||
|
|
# FIXME: On peut en rajouter pour correspondre plus à la configuration
|
||
|
|
# Debian de base. C'est redondant, mais si c'est souhaité, il n'y a
|
||
|
|
# pas de problème.
|
||
|
|
}
|
||
|
|
|
||
|
|
# Ruleset pour envoi des journaux à distance
|
||
|
|
ruleset(name="sendLogsToRemote") {
|
||
|
|
{% if rsyslog_outputs is defined %}
|
||
|
|
{% for output in rsyslog_outputs %}
|
||
|
|
action(
|
||
|
|
type="{{ output_modules[output.proto] }}"
|
||
|
|
|
||
|
|
{% if output_modules[output.proto] == "omfwd" %}
|
||
|
|
protocol="{{ output.proto }}"
|
||
|
|
target="{{ output.address }}"
|
||
|
|
port="{{ output.port }}"
|
||
|
|
{% elif output_modules[output.proto] == "omhiredis" %}
|
||
|
|
server="{{ output.address }}"
|
||
|
|
serverport="{{ output.port }}"
|
||
|
|
mode="publish"
|
||
|
|
key="{{ output.key }}"
|
||
|
|
template="templateJson"
|
||
|
|
{% if output.password is defined %}
|
||
|
|
serverpassword="{{ output.password }}"
|
||
|
|
{% endif %}
|
||
|
|
{% elif output_modules[output.proto] == "omrelp" %}
|
||
|
|
target="{{ output.address }}"
|
||
|
|
port="{{ output.port }}"
|
||
|
|
{% endif %}
|
||
|
|
|
||
|
|
{% if loop.index > 1 and output.fallback %}
|
||
|
|
action.execOnlyWhenPreviousIsSuspended="on"
|
||
|
|
{% endif %}
|
||
|
|
)
|
||
|
|
{% endfor %}
|
||
|
|
{% endif %}
|
||
|
|
}
|
||
|
|
|
||
|
|
# On envoie les journaux locaux vers des fichiers pour aider
|
||
|
|
# au débogage sans avoir à passer par le système de centralisation
|
||
|
|
call sendLogsToDisk
|
||
|
|
|
||
|
|
# On envoie tous les journaux locaux à distance
|
||
|
|
call sendLogsToRemote
|
||
|
|
|