rsyslogサービス | Security Portal

（設定内容）
　・ネットワーク機器からのrsyslogの出力を行う。
　・ネットワーク機器には、サーバのIPアドレスおよびファシリティ名を適切に設定すること。
　　　firewall local1
　　　L3SW local2

# 外部からのメッセージを受け取れるようにモジュールの有効化
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")

# /var/log/messagesへのログ出力の抑止（local1、local2）
*.info;mail.none;authpriv.none;cron.none;local1.none;local2.none  /var/log/messages

# ファシリティ毎の出力ファイルの設定
local1.*                /var/log/firewall.log
local2.*                /var/log/l3sw.log

# 外部からのメッセージを受け取れるようにモジュールの有効化

module(load="imudp")

input(type="imudp" port="514")

module(load="imtcp")

input(type="imtcp" port="514")

# /var/log/messagesへのログ出力の抑止（local1、local2）

*.info;mail.none;authpriv.none;cron.none;local1.none;local2.none /var/log/messages

# ファシリティ毎の出力ファイルの設定

local1.* /var/log/firewall.log

local2.* /var/log/l3sw.log

不要なメッセージ抑止設定サンプル

if $msg contains "ACPI Error:" then stop
if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop
if $programname == "systemd" and ($msg contains ": Succeeded.") then stop
if $programname == "named" and ($msg contains "denied") then stop
if $programname == "named" and ($msg contains "query failed (SERVFAIL)") then stop
if $programname == "named" and ($msg contains "no valid signature found") then stop

if $msg contains "ACPI Error:" then stop

if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop

if $programname == "systemd" and ($msg contains ": Succeeded.") then stop

if $programname == "named" and ($msg contains "denied") then stop

if $programname == "named" and ($msg contains "query failed (SERVFAIL)") then stop

if $programname == "named" and ($msg contains "no valid signature found") then stop

特定のメッセージを検知するとメール送信設定サンプル

個々のメッセージは、各装置が出力するメッセージを事前に確認し設定する。
メールアドレスは、到達可能なメールアドレスを設定する。

# $SystemLogRateLimitInterval 0
$ModLoad ommail
$ActionMailSMTPServer 127.0.0.1
$ActionMailFrom root@sec-portal.jp
$template mail_subject,"rsyslog report mail on %hostname%"
$template mail_body,"rsyslog alert report mail\r\n\r\nmsg='%msg%'"
$ActionMailSubject mail_subject

# UPS Power Fail Shutdown
$ActionMailTo alert@ml.sec-portal.jp
if $msg contains 'UPS: A graceful shutdown process is being' then :ommail:;mail_
body

# L2SW Loop detected
$ActionMailTo alert@ml.sec-portal.jp
if $msg contains 'Loop detected at port' then :ommail:;mail_body

# L3SW Loop detected
$ActionMailTo alert@ml.sec-portal.jp
if $msg contains 'Loop detection has detected a loop' then :ommail:;mail_body

# L3SW MAC Authentication failed
$ActionMailTo alert@ml.sec-portal.jp
if $msg contains 'MAC Authentication failed' then :ommail:;mail_body

# $SystemLogRateLimitInterval 0

$ModLoad ommail

$ActionMailSMTPServer 127.0.0.1

$ActionMailFrom root@sec-portal.jp

$template mail_subject,"rsyslog report mail on %hostname%"

$template mail_body,"rsyslog alert report mail\r\n\r\nmsg='%msg%'"

$ActionMailSubject mail_subject

# UPS Power Fail Shutdown

$ActionMailTo alert@ml.sec-portal.jp

if $msg contains 'UPS: A graceful shutdown process is being' then :ommail:;mail_

body

# L2SW Loop detected

$ActionMailTo alert@ml.sec-portal.jp

if $msg contains 'Loop detected at port' then :ommail:;mail_body

# L3SW Loop detected

$ActionMailTo alert@ml.sec-portal.jp

if $msg contains 'Loop detection has detected a loop' then :ommail:;mail_body

# L3SW MAC Authentication failed

$ActionMailTo alert@ml.sec-portal.jp

if $msg contains 'MAC Authentication failed' then :ommail:;mail_body

管理コマンド

再起動

systemctl restart rsyslog

1	systemctl restart rsyslog

動作確認

# ログへの出力確認
logger -p local1.info "test message."

# メール送信確認
logger -p local3.info "Loop detected at port 10"

# ログへの出力確認

logger -p local1.info "test message."

# メール送信確認

logger -p local3.info "Loop detected at port 10"