robertdebock / ansible-role-rsyslog

Install and configure rsyslog on your system.

Ansible role rsyslog

Install and configure rsyslog on your system.

GitHub	GitLab	Downloads	Version

Example Playbook

This example is taken from molecule/default/converge.yml and is tested on each push, pull request and release.

---
- name: Converge
  hosts: all
  become: true
  gather_facts: true

  roles:
    - role: robertdebock.rsyslog

The machine needs to be prepared. In CI this is done using molecule/default/prepare.yml:

---
- name: Prepare
  hosts: all
  become: true
  gather_facts: false

  roles:
    - role: robertdebock.bootstrap

Also see a full explanation and example on how to use these roles.

Role Variables

The default values for the variables are set in defaults/main.yml:

---
# defaults file for rsyslog

# To configure a server to receive logs, set rsyslog_receiver to yes.
rsyslog_receiver: false

# To forward logs to another server, set rsyslog_remote to the hostname or
# the ipaddress of the receiving rsyslog server.
# Not setting this variable will not forward logs.
# rsyslog_remote: server1.example.com

# If rsylog_remote is set, sets the "selector" pattern for determining which
# messages to send to the remote server.  Default "*.*" sends everything.
# See `man rsyslog.conf`.
rsyslog_remote_selector: "*.*"

# If rsylog_remote is set, use TCP if yes. UDP if no.
rsyslog_remote_tcp: true

# If rsylog_remote is set, destination port to use.
rsyslog_remote_port: 514

# Set the mode for new directories; only available in legacy template.
rsyslog_dircreatemode: "0700"

# Set the mode for new files; only available in legacy template.
rsyslog_filecreatemode: "0644"

# Set the mods enabled
rsyslog_mods:
  - imuxsock
  - imjournal

# Configure rsyslog minimally (may be in conflict with custom configuration files)
rsyslog_deploy_default_config: true

# Default rsyslogd rules
rsyslog_default_rules:
  - { rule: '*.info;mail.none;authpriv.none;cron.none', logpath: '/var/log/messages' }
  - { rule: 'authpriv.*', logpath: '/var/log/secure' }
  - { rule: 'mail.*', logpath: '-/var/log/maillog' }
  - { rule: 'cron.*', logpath: '/var/log/cron' }
  - { rule: '*.emerg', logpath: ':omusrmsg:*' }
  - { rule: 'uucp,news.crit', logpath: '/var/log/spooler' }
  - { rule: 'local7.*', logpath: '/var/log/boot.log' }

# Use the (obsolete) legacy, pre-v6 configuration file format, or the more
# modern # 'advanced' configuration file format available in v6 and up. The
# default is to use the 'legacy' format to not change config files for
# existing users of this role out of the blue.
# More information on the different formats on the rsyslog website:
# https://www.rsyslog.com/doc/v8-stable/configuration/conf_formats.html
rsyslog_config_file_format: legacy

# The rule conf to name to add to /etc/rsyslog.d/
# rsyslog_forward_rule_name: <to fill>

# Configure the rsyslog package to be `present`, or set to `latest` to install
# the latest available version.
rsyslog_package_state: present

# if set to false (legacy default to remain compatible to sysklogd), the domain
# part from a name that is within the same domain as the receiving system is
# stripped. If set to on, full names are always used.
rsyslog_preservefqdn: false

# Configure additional config files in /etc/rsyslog.d
# Example:
# rsyslog_rsyslog_d_files:
#   000-splunk:
#     content: |
#       auth,authpriv.* action(type="omfwd"
#                              target="splunk"
#                              port="514"
#                              protocol="tcp")
rsyslog_rsyslog_d_files: []

# Avoid sd_journal_get_cursor() failed: Cannot assign requested address messages
# due to logrotate
rsyslog_workaroundjournalbug: false

# Turns off message reception via local log socket
rsyslog_imuxsock_syssock: false

# Install additional rsyslog packages
# Example for installing rsyslog-elastisearch:
# rsyslog_features:
#   - gnutls
#   - elastisearch
rsyslog_features: []

# Default destination of rsyslog config file
rsyslog_dest_conf_file: "/etc/rsyslog.conf"

# Enable / Disable option OmitLocalLogging
rsyslog_omit_local_logging: true

# Allow using the traditional file format.
rsyslog_traditional_file_format: true

Requirements

• pip packages listed in requirements.txt.

State of used roles

The following roles are used to prepare a system. You can prepare your system in another way.

Requirement	GitHub	GitLab
robertdebock.bootstrap

Context

This role is a part of many compatible roles. Have a look at the documentation of these roles for further information.

Here is an overview of related roles:

Compatibility

This role has been tested on these container images:

container	tags
Alpine	all
Amazon	Candidate
EL	8, 9
Debian	all
Fedora	all
opensuse	all
Ubuntu	all

The minimum version of Ansible required is 2.12, tests have been done to:

• The previous version.
• The current version.
• The development version.

If you find issues, please register them in GitHub.

License

Apache-2.0.

Author Information

robertdebock

Please consider sponsoring me.

ansible-role-rsyslog's Issues

Support passing extra parameters to `omfwd`

Proposed feature

Allow passing custom parameters to omfwd, for example, for TLS configuration.

Rationale

This feature is needed to allow customizing the client setup for omfwd: https://www.rsyslog.com/doc/master/tutorials/tls.html#client-setup

Additional context

A hack/workaround is as follows:

rsyslog_remote_extra_params: >-
  StreamDriver="gtls"
  StreamDriverMode="1"
  StreamDriverAuthMode="x509/certvalid"
# Hack: This role doesn't support passing custom parameters to omfwd, so we
# inject them via rsyslog_remote (including removing the trailing '"', which
# is added back by the template in the role:
# https://github.com/robertdebock/ansible-role-rsyslog/blob/fdee66ebfe1514729c0548051895240757f43e19/templates/advanced_rsyslog.conf.j2#L108
rsyslog_remote: 'log.example.com" {{ rsyslog_remote_extra_params[:-1] }}'

Please consider sponsoring me.

Documentation does not cover how to configure receiver

ISSUE TYPE

• Documentation Report

SUMMARY

In defaults/main.yml there is reference to how to setup a receiver, but the documenation misses this.

rsyslog_receiver boolean behavior is unintuitive

ansible-role-rsyslog/defaults/main.yml

Line 6 in fadc2a2

# rsyslog_receiver: yes

ansible-role-rsyslog/templates/advanced_rsyslog.conf.j2

Line 31 in fadc2a2

{{ '' if rsyslog_receiver is defined else '#' }}module(load="imudp") # needs to be done just once

Describe the bug

By default, rsyslog_receiver is undefined (because it's commented out in defaults/main.yml) and its value is ignored if it is set, since all references to it (in templates/advanced_rsyslog.conf.j2, templates/legacy_rsyslog.conf.j2, etc.) only check whether it's defined ("{{ '' if rsyslog_receiver is defined else '#' }}", etc.).

If defined, it does need to be a boolean (because of the checks in tasks/assert.yml), but the role's behavior is unintuitive, since setting it to no does configure the server to receive logs (just like setting it to yes).

Proposed fix

• Make rsyslog_receiver required (always defined) by setting a default value (no) in defaults/main.yml and removing the when conditional for its type checking in tasks/assert.yml
• Instead of checking for if rsyslog_receiver is defined, check for if rsyslog_receiver, which will behave as expected once the value is always defined and set to boolean yes or no

Support specifying no rsyslog_mods

Proposed feature

Currently the assertions check if rsyslog_mods is defined/empty, and fails if it there isn't at least 1 module loaded. However, this validation seems unnecessary none of the allowed rsyslog_mods are strictly required.

I'm using rsyslog purely as a receiver of logs from other hosts to be forwarded to another log processing tool.

I'm using journald to provide /dev/log so I don't need immuxsock. I don't want to use imjournal because I don't want the host's journal logs to go to rsyslog. imklog and immark aren't really needed for me either.

I propose the validation on rsyslog_mods is either removed or changed to allow specifying an empty list.

Empty forward rule file created

Empty forward rule file created

I set rsyslog_deploy_default_config: no and got this error:

TASK [robertdebock.rsyslog : Configuring rsyslog forward rule] *****************
fatal: [myhostname]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'rsyslog_forward_rule_name' is undefined\n\nThe error appears to be in '/runner/requirements_roles/robertdebock.rsyslog/tasks/main.yml': line 41, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Configuring rsyslog forward rule\n  ^ here\n"}

I then set rsyslog_forward_rule_name: forwarding and it generated this file:

#
# Ansible managed
#

# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#

# ### end of the forwarding rule ###

I don't understand the purpose of this so I thought I'd ask if the role is behaving as intended?

Playbook

---
- hosts: "all"
  roles:
    - role: robertdebock.rsyslog
      vars:
        rsyslog_deploy_default_config: no
        rsyslog_forward_rule_name: forwarding

Output

As described above.

Environment

• Control node OS: Debian 11
• Control node Ansible version: 2.12.5.post0
• Managed node OS: Ubuntu 18.04

'rsyslog_remote_template'' is undefined

Describe the bug

TASK [rsyslog : Configuring default rsyslog] ***********************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ansible.errors.AnsibleUndefinedVariable: 'rsyslog_remote_template' is undefined
fatal: [myhost]: FAILED! => changed=false 
  msg: 'AnsibleUndefinedVariable: ''rsyslog_remote_template'' is undefined'

This seems to be related to the code intruduced in #30 . It checks if variables are true, rather than defined.

Please add option to turn off "RSYSLOG_TraditionalFileFormat"

Proposed feature

Now RSYSLOG_TraditionalFileFormat is hardcoed into template. I'd like to have option to turn it off.

Update file permissions to enforce security

Proposed feature

For security reason, it's recommended to set root as the owner and group and have a 0600 permissions on rsyslog files

Rationale

Security reasons (CF CIS : https://github.com/ansible-lockdown/RHEL7-CIS/tree/main)

Additional context

I might create a merge request monday if you don't see any trouble using this permissions ?
Do you prefere I propose a merge with fixed values or with variables values ?

failing on assert.yml in version 4..4.1

Describe the bug

play fails on assert.yml.

Playbook

---
- hosts: all
  become: true
  tasks:

    - name: install robertdebock.rsyslog
      include_role:
        name: robertdebock.rsyslog

Output

ERROR! this task 'ansible.builtin.import_tasks' has extra params, which is only allowed in the following modules: ansible.windows.win_command, win_command, win_shell, include_vars, group_by, ansible.windows.win_shell, add_host, shell, import_tasks, include_tasks, script, raw, set_fact, import_role, command, meta, include_role, include

The error appears to be in '/home/user/code/master/roles/robertdebock.rsyslog/tasks/main.yml': line 4, column 3, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:


- name: import assert.yml
  ^ here

Environment

• Control node OS: CentOS Linux release 7.7.1908 (Core)
• Control node Ansible version: ansible 2.10.3
• Managed node OS: Centos7

Please consider sponsoring me.

Asserted type for rsyslog_dircreatemode and rsyslog_filecreatemode is incorrect

Describe the bug

The assert.yml task list asserts that the rsyslog_dircreatemode and rsyslog_filecreatemode variables should be numbers.
Before fa480e9, this assert was | int, which did pass, but didn't actually test that the variable was set correctly.

Rsyslog's documentation specifies:

The value given must always be a 4-digit octal number, with the initial digit being zero

https://www.rsyslog.com/doc/v8-stable/configuration/action/rsconf1_filecreatemode.html

It might be better to specify the variable as an octal number, then ensure that it is formatted correctly in the template.

Output

    TASK [ansible-role-rsyslog : test if rsyslog_dircreatemode is set correctly] ***
fatal: [rsyslog-alpine-latestpy38-ansible-current]: FAILED! => changed=false 
  assertion: rsyslog_dircreatemode is number
  evaluated_to: false
  msg: Assertion failed

https://github.com/robertdebock/ansible-role-rsyslog/runs/1383861975

Using 'advanced' mode on CentOS 7 seems to be fraught with errors

Describe the bug

A clear and concise description of what the bug is.

Playbook

I am running robertdebock.rsyslog 4.6.0 against a CentOS-7 VirtualBox VM (latest bento/centos-7)

Variables going in to the include_role:

rsyslog_config_file_format: advanced
rsyslog_default_rules:
  - { rule: "authpriv.*", logpath: "/var/log/secure" }
  - { rule: "mail.*", logpath: "-/var/log/mail" }
  - { rule: "mail.info", logpath: "-/var/log/mail.info" }
  - { rule: "mail.warning", logpath: "-/var/log/mail.warn" }
  - { rule: "mail.err", logpath: "-/var/log/mail.err" }
  - { rule: "news.crit", logpath: "-/var/log/news/news.crit" }
  - { rule: "news.err", logpath: "-/var/log/news/news.err" }
  - { rule: "news.notice", logpath: "-/var/log/news/news.notice" }
  - { rule: "cron.*", logpath: "/var/log/cron" }
  - { rule: "*.emerg", logpath: ":omusrmsg:*" }
  - { rule: "uucp,news.crit", logpath: "/var/log/spooler" }
  - { rule: "local7.*", logpath: "/var/log/boot.log" }
  - { rule: "*.=warning;*.=err", logpath: "-/var/log/warn" }
  - { rule: "*.crit", logpath: "/var/log/warn" }
  - { rule: "*.*;mail.none;authpriv.none;cron.none;news.none", logpath: "-/var/log/messages" }
  - { rule: "local0,local1.*", logpath: "-/var/log/localmessages" }
  - { rule: "local2,local3.*", logpath: "-/var/log/localmessages" }
  - { rule: "local4,local5.*", logpath: "-/var/log/localmessages" }
  - { rule: "local6,local7.*", logpath: "-/var/log/localmessages" }
rsyslog_deploy_default_config: yes
rsyslog_dircreatemode: "0700"
rsyslog_features: []
rsyslog_filecreatemode: "0644"
rsyslog_mods:
  - imjournal
rsyslog_imuxsock_syssock: no
rsyslog_package_state: present
rsyslog_preservefqdn: no
rsyslog_receiver: no
rsyslog_remote_port: 514
rsyslog_remote_selector: "*.*"
rsyslog_remote_tcp: yes
rsyslog_rsyslog_d_files: []
rsyslog_workaroundjournalbug: no

What this outputs to /etc/rsyslog.conf:

#
# Ansible managed: Do NOT edit this file manually!
#
# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html


#################
#### MODULES ####
#################

# Provides support for local system logging (e.g. via logger command)
# And turns off message reception via local log socket;
# Local messages are retrieved through imjournal now.
#module(load="imuxsock" SysSock.Use="off")

# Provides access to the systemd journal
# And provides file to store the position in the journal
module(load="imjournal" StateFile="imjournal.state")

# provides kernel logging support
#module(load="imklog")

# provides --MARK-- message capability
#module(load="immark")

# provides access to specific log file
#module(load="imfile")

# provides UDP syslog reception
#module(load="imudp") # needs to be done just once
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp") # needs to be done just once
#input(type="imtcp" port="514")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

#
# Set the default permissions for all log files.
#
$FileCreateMode 0644
$DirCreateMode 0700

#
# Where to place spool and state files
#
global(workDirectory="/var/lib/rsyslog")


#
# Include all config files in /etc/rsyslog.d/
#
include(file="/etc/rsyslog.d/*.conf" mode="optional")

###############
#### RULES ####
###############

authpriv.* /var/log/secure
mail.* -/var/log/mail
mail.info -/var/log/mail.info
mail.warning -/var/log/mail.warn
mail.err -/var/log/mail.err
news.crit -/var/log/news/news.crit
news.err -/var/log/news/news.err
news.notice -/var/log/news/news.notice
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
*.=warning;*.=err -/var/log/warn
*.crit /var/log/warn
*.*;mail.none;authpriv.none;cron.none;news.none -/var/log/messages
local0,local1.* -/var/log/localmessages
local2,local3.* -/var/log/localmessages
local4,local5.* -/var/log/localmessages
local6,local7.* -/var/log/localmessages

Output

Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig systemd: Starting System Logging Service...
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-57.el7_9.1" x-pid="7450" x-info="http://www.rsyslog.com"] start
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: action 'include' treated as ':omusrmsg:include' - please use ':omusrmsg:include' syntax instead, 'include' will not be supported in the future [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2184 ]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 65: warnings occured in file '/etc/rsyslog.conf' around line 65 [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2207 ]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 65: invalid character '(' - is there an invalid escape sequence somewhere? [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2207 ]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: action 'file' treated as ':omusrmsg:file' - please use ':omusrmsg:file' syntax instead, 'file' will not be supported in the future [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2184 ]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 65: warnings occured in file '/etc/rsyslog.conf' around line 65 [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2207 ]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 65: invalid character '=' - is there an invalid escape sequence somewhere? [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2207 ]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 65: invalid character '"' - is there an invalid escape sequence somewhere? [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2207 ]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: invalid character in selector line - ';template' expected [v8.24.0-57.el7_9.1]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 65: errors occured in file '/etc/rsyslog.conf' around line 65 [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2207 ]
Mar  2 16:52:57 vagrant-centos-7-vagrant-centos-7-stig systemd: Started System Logging Service.

Environment

• Control node OS: [e.g. Debian 9] (cat /etc/os-release)

Control node is MacOS Catalina

• Control node Ansible version: [e.g. 2.9.1] (ansible --version)

ansible [core 2.12.3]
  config file = None
  configured module search path = ['/Users/isuftin/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /Users/isuftin/.pyenv/versions/3.9.10/envs/ctek-development/lib/python3.9/site-packages/ansible
  ansible collection location = /Users/isuftin/.ansible/collections:/usr/share/ansible/collections
  executable location = /Users/isuftin/.pyenv/versions/ctek-development/bin/ansible
  python version = 3.9.10 (main, Jan 31 2022, 16:09:50) [Clang 12.0.0 (clang-1200.0.32.29)]
  jinja version = 3.0.3
  libyaml = True

• Managed node OS: [e.g. CentOS 7] (cat /etc/os-release)

NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

Please consider sponsoring me.

Possibility to add multiple rsyslog_remote destinations

Proposed feature

Ability to configure multiple Forwarding rules directly with an array.

Rationale

Sometimes you want to send different selectors to different servers.
And possibly using TCP to one server and UDP to the other.
*.warn @@syslog02
*.info @syslog01

Additional context

Anyone else that have a similar use-case?

wrong $WorkDirectory in ubuntu

Describe the bug

ubuntu18.04 uses $WorkDirectory /var/spool/rsyslog but this role deploys $WorkDirectory /var/lib/rsyslog .

folder /var/spool/rsyslog doesn't exists at all in ubuntu

Output

when doing systemctl status rsyslog you get this error message:

$WorkDirectory: /var/lib/rsyslog can not be accessed, probably does not exist - directive ignored

Add permission parameters for omfile

Is your feature request related to a problem? Please describe.
I'd like to control the $FileCreateMode option for omfile.
I'm working on implementing the requirements of the CIS Benchmark for RHEL 7, which requires setting $FileCreateMode to 0640, rather than the default of 0644

Describe the solution you'd like
Add the directive to the template, along with the default value from the ryslog doco

Describe alternatives you've considered
There are a few other roles which provide more completely templated configurations, but they are a lot more complicated to use.

Does it works on RHEL6?

Proposed feature

Shame on me but I still have a bunch of servers with RHEL6, currently unmanaged, and I'd like to know if your role works on these.

Rationale

Probably it work also on RHEL6 because it has rsyslog-5.8.10