Configuring Syslog¶

Syslog over UDP

Collect the following information from your Syslog administrator:
- Host: The hostname or IP address of your Syslog instance (e.g. syslog.example.com).
- Port: The Syslog port, typically 514.
- Format: The syslog format to use, either rfc3164 or rfc5424.
- AppName: The appname to which the audit logs should be associated (e.g. linux-audit).

Edit the fluent-bit configuration

[artesca-os@bootstrap ~]$

export SYSLOG_HOST="<syslog-host>"
export SYSLOG_PORT="514"
export SYSLOG_APPNAME="<syslog-appname>"
export SYSLOG_FORMAT="<syslog-format>"

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: metalk8s-fluent-bit-config
  namespace: metalk8s-logging
data:
  config.yaml: |-
    apiVersion: addons.metalk8s.scality.com
    kind: FluentBitConfig
    spec:
      config:
        output:
          - Name: syslog
            Match: audit.*
            Host: "$SYSLOG_HOST"
            Port: "$SYSLOG_PORT"
            Mode: udp
            Syslog_Format: "$SYSLOG_FORMAT"
            Syslog_HostName_Key: hostname
            Syslog_AppName_Preset: "$SYSLOG_APPNAME"
            Syslog_Message_Key: log
EOF

Update bootstrap configuration

[artesca-os@bootstrap ~]$

sudo salt-call --local state.single file.serialize \
  /etc/metalk8s/bootstrap.yaml \
  dataset="{ \
    'addons': { \
      'fluent-bit': { \
        'enabled': True \
      }, \
    } \
  }" \
  serializer=yaml merge_if_exists=True show_changes=True

Export the MetalK8s version you are using as an environment variable:

[artesca-os@bootstrap ~]$

export MK8SVERSION=`sudo kubectl \
    --kubeconfig=/etc/kubernetes/admin.conf \
    get cm -n kube-system artesca-version \
    -o jsonpath="{.data.metalk8s}"`

Apply the changes

[artesca-os@bootstrap ~]$

sudo kubectl exec --kubeconfig /etc/kubernetes/admin.conf \
    $(sudo kubectl --kubeconfig /etc/kubernetes/admin.conf get pod -n kube-system -l app=salt-master -o name) \
    -n kube-system -c salt-master -- \
    salt-run state.sls metalk8s.addons.logging.deployed \
    saltenv=metalk8s-$MK8SVERSION

Syslog over TCP

Collect the following information from your Syslog administrator:
- Host: The hostname or IP address of your Syslog instance (e.g. syslog.example.com).
- Port: The Syslog port, typically 6514.
- Format: The syslog format to use, either rfc3164 or rfc5424.
- AppName: The appname to which the audit logs should be associated (e.g. linux-audit).
- TLS certificates: Download the following files from your Syslog administrator:
  - syslog_ca.crt — the CA certificate that signed the Syslog server certificate.

Edit the fluent-bit configuration

[artesca-os@bootstrap ~]$

export SYSLOG_HOST="<syslog-host>"
export SYSLOG_PORT="6514"
export SYSLOG_APPNAME="<syslog-appname>"
export SYSLOG_FORMAT="<syslog-format>"

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: metalk8s-fluent-bit-config
  namespace: metalk8s-logging
data:
  config.yaml: |-
    apiVersion: addons.metalk8s.scality.com
    kind: FluentBitConfig
    spec:
      config:
        output:
          - Name: syslog
            Match: audit.*
            Host: "$SYSLOG_HOST"
            Port: "$SYSLOG_PORT"
            Mode: tcp
            Syslog_Format: "$SYSLOG_FORMAT"
            Syslog_HostName_Key: hostname
            Syslog_AppName_Preset: "$SYSLOG_APPNAME"
            Syslog_Message_Key: log
            TLS: On
            TLS.Verify: On
            TLS.ca_file: /fluent-bit/etc/tls/syslog_ca.crt
EOF

Add the certificates to Fluent Bit
Note

Before running the command below, copy the certificate files to the home directory of the bootstrap node (/home/artesca-os/) with the following exact names:
- syslog_ca.crt
Once the command has completed, delete them from the node.
[artesca-os@bootstrap ~]$
sudo kubectl --kubeconfig /etc/kubernetes/admin.conf \ patch secret -n metalk8s-logging fluent-bit-certs -p \ '{"data":{ "syslog_ca.crt":"'"$(base64 -w 0 syslog_ca.crt)"'" }}'

Update bootstrap configuration

[artesca-os@bootstrap ~]$

sudo salt-call --local state.single file.serialize \
  /etc/metalk8s/bootstrap.yaml \
  dataset="{ \
    'addons': { \
      'fluent-bit': { \
        'enabled': True \
      }, \
    } \
  }" \
  serializer=yaml merge_if_exists=True show_changes=True

Export the MetalK8s version you are using as an environment variable:

[artesca-os@bootstrap ~]$

export MK8SVERSION=`sudo kubectl \
    --kubeconfig=/etc/kubernetes/admin.conf \
    get cm -n kube-system artesca-version \
    -o jsonpath="{.data.metalk8s}"`

Apply the changes

[artesca-os@bootstrap ~]$

sudo kubectl exec --kubeconfig /etc/kubernetes/admin.conf \
    $(sudo kubectl --kubeconfig /etc/kubernetes/admin.conf get pod -n kube-system -l app=salt-master -o name) \
    -n kube-system -c salt-master -- \
    salt-run state.sls metalk8s.addons.logging.deployed \
    saltenv=metalk8s-$MK8SVERSION

Syslog with mTLS

Collect the following information from your Syslog administrator:
- Host: The hostname or IP address of your Syslog instance (e.g. syslog.example.com).
- Port: The Syslog port, typically 6514.
- Format: The syslog format to use, either rfc3164 or rfc5424.
- AppName: The appname to which the audit logs should be associated (e.g. linux-audit).
- TLS certificates: Download the following files from your Syslog administrator:
  - syslog_ca.crt — the CA certificate that signed the Syslog server certificate.
  - syslog_client.crt and syslog_client.key — a client certificate/key pair for mutual TLS authentication.

Edit the fluent-bit configuration

[artesca-os@bootstrap ~]$

export SYSLOG_HOST="<syslog-host>"
export SYSLOG_PORT="6514"
export SYSLOG_APPNAME="<syslog-appname>"
export SYSLOG_FORMAT="<syslog-format>"

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: metalk8s-fluent-bit-config
  namespace: metalk8s-logging
data:
  config.yaml: |-
    apiVersion: addons.metalk8s.scality.com
    kind: FluentBitConfig
    spec:
      config:
        output:
          - Name: syslog
            Match: audit.*
            Host: "$SYSLOG_HOST"
            Port: "$SYSLOG_PORT"
            Mode: tcp
            Syslog_Format: "$SYSLOG_FORMAT"
            Syslog_HostName_Key: hostname
            Syslog_AppName_Preset: "$SYSLOG_APPNAME"
            Syslog_Message_Key: log
            TLS: On
            TLS.Verify: On
            TLS.ca_file: /fluent-bit/etc/tls/syslog_ca.crt
            TLS.crt_file: /fluent-bit/etc/tls/syslog_client.crt
            TLS.key_file: /fluent-bit/etc/tls/syslog_client.key
EOF

Add the certificates to Fluent Bit

Note

Before running the command below, copy the certificate files to the home directory of the bootstrap node (/home/artesca-os/) with the following exact names:

syslog_ca.crt
syslog_client.crt
syslog_client.key

Once the command has completed, delete them from the node.

[artesca-os@bootstrap ~]$

sudo kubectl --kubeconfig /etc/kubernetes/admin.conf \
   patch secret -n metalk8s-logging fluent-bit-certs -p \
   '{"data":{
     "syslog_ca.crt":"'"$(base64 -w 0 syslog_ca.crt)"'",
     "syslog_client.crt":"'"$(base64 -w 0 syslog_client.crt)"'",
     "syslog_client.key":"'"$(base64 -w 0 syslog_client.key)"'"
   }}'

Update bootstrap configuration

[artesca-os@bootstrap ~]$

sudo salt-call --local state.single file.serialize \
  /etc/metalk8s/bootstrap.yaml \
  dataset="{ \
    'addons': { \
      'fluent-bit': { \
        'enabled': True \
      }, \
    } \
  }" \
  serializer=yaml merge_if_exists=True show_changes=True

Export the MetalK8s version you are using as an environment variable:

[artesca-os@bootstrap ~]$

export MK8SVERSION=`sudo kubectl \
    --kubeconfig=/etc/kubernetes/admin.conf \
    get cm -n kube-system artesca-version \
    -o jsonpath="{.data.metalk8s}"`

Apply the changes

[artesca-os@bootstrap ~]$

sudo kubectl exec --kubeconfig /etc/kubernetes/admin.conf \
    $(sudo kubectl --kubeconfig /etc/kubernetes/admin.conf get pod -n kube-system -l app=salt-master -o name) \
    -n kube-system -c salt-master -- \
    salt-run state.sls metalk8s.addons.logging.deployed \
    saltenv=metalk8s-$MK8SVERSION