7:15 p.m.
On lip 24, Jan Kowalsky wrote:
in the past we used rsyslog role for log forwarding. Since
everything
was in private subnet (inside VPN) we didn't use pki.
With the same configuration:
rsyslog__forward: [ '*.* @@logger0.datenkollektiv.net', '*.* ~' ]
rsyslog__pki: False
the remote-forward rule isn't created anymore in /etc/rsyslog.d/
The reason seems to be complete redesign of the rsyslog role. Looks like
this is responsible:
+ - name: '00forward-logs.conf'
+ state: '{{ "present"
+ if (rsyslog__forward_enabled|bool and
+ rsyslog__pki|bool)
+ else "absent" }}'
+ options:
so any forwarding is ignored if rsyslog__pki is set to false.
Is there any way to work around this?
Yes, there is. You can enable the '00forward-logs.conf' file via the
inventory, like this:
rsyslog__rules:
- name: '00forward-logs.conf'
state: 'present'
This will enable the file overriding the PKI condition. Keep in mind that the
format of the 'rsyslog__forward' variable also changed, check [1] for details.
I guess including documentation for how to enable forwarding without PKI
enabled would be a good idea.
Wouldn't it better to have the choice between encrypted and
unencrypted
logging forwarding?
There is a choice, unencrypted forwarding is just a bit more involved (but
undocumented, apparently). I think it's a good approach too, since forwarding
will be enabled automatically with SRV resource records in DNS. I wouldn't
want to reveal confidental information in the logs by mistake.
Let me know if that helped.
-- Maciej
[1]:
https://docs.debops.org/en/master/ansible/roles/rsyslog/defaults-detailed...