Présentation

Utilisez rsyslog ou syslog-ng d’Observability Pipelines pour recevoir les logs envoyés à rsyslog ou syslog-ng.

Vous pouvez également transférer des logs tiers vers syslog puis les envoyer à l’Observability Pipelines Worker.

Prérequis

To use Observability Pipelines’ Syslog source, your applications must be sending data in one of the following formats: RFC 6587, RFC 5424, RFC 3164. You also need to have the following information available:

1. The bind address that your Observability Pipelines Worker (OPW) will listen on to receive logs from your applications. For example, 0.0.0.0:8088. Later on, you configure your applications to send logs to this address.
2. The appropriate TLS certificates and the password you used to create your private key if your forwarders are globally configured to enable SSL.

Configuration

Configurez cette source lorsque vous configurez un pipeline. Vous pouvez configurer un pipeline dans l’UI, en utilisant l’API ou avec Terraform. Les instructions de cette section concernent la configuration de la source dans l’UI.

Après avoir sélectionné la source Syslog dans l’interface utilisateur du pipeline :

1. Saisissez l’identifiant de votre adresse syslog. Si vous le laissez vide, le default est utilisé.
2. Dans le menu déroulant Socket Type, sélectionnez le protocole de communication que vous souhaitez utiliser : TCP ou UDP.

Paramètres TLS optionnels

Toggle the switch to Enable TLS.

• If you are using Secrets Management, enter the identifier for the key pass. See Secret defaults for the default used if the field is left blank.
• Enter the following certificate and key files:
  • Server Certificate Path: The path to the certificate file that has been signed by your Certificate Authority (CA) root file in DER, PEM, or CRT (X.509).
  • (Optional) CA Certificate Path: The path to the certificate file that is your Certificate Authority (CA) root file in DER, PEM, or CRT (X.509).
  • (Optional) Private Key Path: The path to the .key private key file that belongs to your Server Certificate Path in DER, PEM, or CRT (PKCS #8) format.
  • Notes:
    • The configuration data directory /var/lib/observability-pipelines-worker/config/ is automatically appended to the file paths. See Advanced Worker Configurations for more information.
    • The file must be readable by the observability-pipelines-worker group and user.

• (Optional) Toggle Verify certificate to require connecting clients to present a valid client certificate. This enforces mutual TLS (mTLS), where the Worker verifies the identity of each connecting client.

Valeurs par défaut des secrets

These are the defaults used for secret identifiers and environment variables.

Envoyez des logs à l’Observability Pipelines Worker via syslog

rsyslog

To send rsyslog logs to the Observability Pipelines Worker, update your rsyslog config file:

ruleset(name="infiles") {
action(type="omfwd" protocol="tcp" target="<OPW_HOST>" port="<OPW_PORT>")
}

<OPW_HOST> is the IP/URL of the host (or load balancer) associated with the Observability Pipelines Worker.

• For CloudFormation installs, the LoadBalancerDNS CloudFormation output has the correct URL to use.
• For Kubernetes installs, the internal DNS record of the Observability Pipelines Worker service can be used, for example opw-observability-pipelines-worker.default.svc.cluster.local.

syslog-ng

To send syslog-ng logs to the Observability Pipelines Worker, update your syslog-ng config file:

destination obs_pipelines {
  http(
      url("<OPW_HOST>")
      method("POST")
      body("﹤${PRI}>1 ${ISODATE} ${HOST:--} ${PROGRAM:--} ${PID:--} ${MSGID:--} ${SDATA:--} $MSG\n")
  );
};

<OPW_HOST> is the IP/URL of the host (or load balancer) associated with the Observability Pipelines Worker.

• For CloudFormation installs, the LoadBalancerDNS CloudFormation output has the correct URL to use.
• For Kubernetes installs, the internal DNS record of the Observability Pipelines Worker service can be used, for example opw-observability-pipelines-worker.default.svc.cluster.local.

Transférez des logs tiers à l’Observability Pipelines Worker

Syslog est un protocole de journalisation largement utilisé pour envoyer des logs réseau à un serveur central. De nombreux périphériques réseau prennent en charge la sortie syslog, vous pouvez donc transférer des logs tiers vers la source syslog d’Observability Pipelines pour traitement et routage. Voici des exemples de ces services tiers :

Fortinet

• Configurez le transfert de logs
• Configuration des paramètres syslog

Palo Alto Networks

• Configurez le transfert de logs
• Transférez les logs de trafic vers un serveur syslog