Syslog - Installation Guide - BlueCat Integrity - 26.1.0

#cloud-config
bluecat_service_config:
  payload: |
   {
      "version": "1.4.0",
      "services": {
        "syslog": {
          "configurations": [
            {
              "syslogConfiguration": {
                "version": "2.0",
                "localSyslog": {
                  "withIsoTimestamp": false
                },
                "servers": [
                    {
                      "ip": "10.0.0.0",
                      "level": "info",
                      "transport": "tls",
                      "port": 514,
                      "serviceTypes": [
                        "v1Api"
                      ],
                      "useRFC5424": false,
                      "withIsoTimestamp": false,
                      "tlsSettings": {
                          "peerVerify": "optional-untrusted",
                          "caCert": "<PEM certificate>"
                      }
                    },
                    {
                      "ip": "10.244.100.20",
                      "level": "info",
                      "transport": "udp",
                      "port": 514,
                      "serviceTypes": [
                        "v1Api",
                        "v2RestApi",
                        "others"
                      ],
                      "useRFC5424": false,
                      "withIsoTimestamp": false
                   }
               ]
             }
           }
         ]
       }
     }
   }

• version—enter the syslog configuration schema version.
• localSyslog—enter the local syslog configuration.
  • withIsoTimestamp—set to true to use the ISO 8601 timestamp format for locally logged messages; set to false if you do not want to use the ISO 8601 timestamp format for locally logged messages. The format is as follows: YYYY-MM-DDTHH:mm:ss+-ZONE. For example, 2022-10-13T15:58:00+01:00.

    If you set this value to false, locally logged messages use the legacy BSD timestamp.

• servers—enter the configuration information for syslog redirection to a syslog server.
  • ip—enter the IP address of the syslog server.
  • level—enter the logging level that is sent to the syslog server. The logging level can be one of the following:
    • info—informational messages of system events.
    • notice—indicates normal but significant conditions within the system.
    • warning—indicates warning conditions within the system.
    • err—indicates error conditions within the system.
    • crit—indicates critical conditions within the system.
    • alert—indicates that action must be taken immediately.
    • emerg—indicates that the system is unusable.
  • transport—enter the transport protocol used for syslog redirection. The value must be tcp, udp, or tls.
    If you enter tls, enter the following additional fields:

    • peerVerify—set the verification method of the remote peer. You can set one of the following values:
      • required-trusted—the connection is TLS-encrypted if the remote peer has a valid certificate.
      • required-untrusted—the connection is TLS-encrypted if the remote peer has an invalid certificate or valid certificate.
      • optional-trusted—the connection is TLS-encrypted if the remote peer has no certificate or a valid certificate.
      • optional-untrusted—the connection is TLS-encrypted if the remote peer has no certificate, an invalid certificate, or a valid certificate.
        Note: If you set the peerVerify method to optional-untrusted, the CA certificate is optional.
    • caCert—enter the content of CA certificate used to verify the server certificate during the TLS handshake. The caCert must be in PEM format.
    • clientCert—(Optional) enter the content of the client certificate to use for authentication. The client certificate must be in PEM format.
    • clientKey—(Optional) enter the content of the client private key to use for authentication. The client private key must be in PEM format and must not be password-protected.
      Attention: If you enter a clientCert, you must also enter a clientKey.

    Note: If you select tls as the transport protocol, you must also set useRFC5424 and withIsoTimestamp to true.
  • port—enter the port used for syslog redirection.
  • serviceTypes—select the services for which syslog messages are generated. The value must be v1Api, v2RestApi, or others.
  • useRFC5424—set to true to use the RFC5424 syslog protocol for syslog messages; set to false if you do not want to use the RFC5424 syslog protocol for syslog messages. For more information on RFC5424, refer to https://datatracker.ietf.org/doc/rfc5424/.

    If you set this value to false, syslog messages use the legacy BSD RFC3164 syslog protocol. For more information on RFC3614, refer to https://datatracker.ietf.org/doc/rfc3164/.

  • withIsoTimestamp—set to true to use the ISO 8601 timestamp format for syslog messages; set to false if you do not want to use the ISO 8601 timestamp format for syslog messages redirected to a remote syslog server. The format is as follows: YYYY-MM-DDTHH:mm:ss+-ZONE. For example, 2022-10-13T15:58:00+01:00.
    Attention:

    • If you set useRFC5424 to true, you must also set withIsoTimestamp to true.
    • If you set this value to false, syslog messages use the legacy BSD timestamp.