Syslogs for auth.log

trackstar2000 · 03-06-2023, 01:10 PM

Hey there,

Does anybody have examples how to get it to ship the auth.log. I installed rsyslog on Ubuntu (latest version) for both the server and client.

Thanks,
TT

Turbocapitalist · 03-07-2023, 10:48 PM

Ship what, specifically? If you're looking for the format for the rsyslog configuration, then see "man 5 rsyslog.conf" and look in the files in /etc/rsyslog.d/ for what's already there for examples. However, the latest Ubuntu is afflicted with systemd for logging and eleventy other essential functions.

trackstar2000 · 03-08-2023, 06:01 PM

Quote:

Originally Posted by Turbocapitalist

Ship what, specifically? If you're looking for the format for the rsyslog configuration, then see "man 5 rsyslog.conf" and look in the files in /etc/rsyslog.d/ for what's already there for examples. However, the latest Ubuntu is afflicted with systemd for logging and eleventy other essential functions.

I want to have the auth.log from a machine be sent to the syslog server. I have looked at the rsyslog.d a bit. Will dig deeper...

TT

Turbocapitalist · 03-08-2023, 10:30 PM

Quote:

Originally Posted by trackstar2000

I want to have the auth.log from a machine be sent to the syslog server. I have looked at the rsyslog.d a bit. Will dig deeper...

Thanks.

Then you might want to look at the long tutorial on that, Encrypting Syslog Traffic with TLS (SSL) as well as the short tutorial, Encrypting Syslog Traffic with TLS (SSL) [short version]. There are some steps involved but it's doable. TLS is necessary these days to prevent not just the messages being read by others but falsified messages being injected into the system. If the machines are on the same LAN, that can be less of a priority but TLS should still be used out of good practice.