Skip to main content

Linux (RHEL) Syslog

Enterprise Linux servers — Red Hat Enterprise Linux and the rebuilds that track it, such as Rocky, AlmaLinux and CentOS — record their operational and security activity through rsyslog and the systemd journal. The security-relevant portion is concentrated in a few facilities: authentication and privilege escalation (sshd, sudo, su, PAM), scheduled task execution, package management, service starts and stops, and kernel messages. Forwarding these gives the platform host-level visibility on the servers that usually matter most — a failed-then-successful SSH login from a new address, or an unexpected sudo to root, is visible nowhere else.

Device-side setup​

Configure the device to forward syslog to the listener described below, following the vendor's own documentation for its syslog export. Nothing has to be built on the platform side beyond installing the template below — it supplies the parser and wires the pipeline.

Syslog configuration​

Hosts send to a syslog listener: either the cloud syslog endpoint or a local collector appliance. The two destinations use different ports. The cloud endpoint has a per-tenant domain and a block of ports allocated to your account: Platform → Administration → Syslog Ports shows the domain, the port range, and which protocol listens on which port — read the numbers off that page rather than assuming a standard one. A collector appliance listens by default on UDP/514, TCP/514, TLS on 6514 and TLS RFC 6587 on 7514, and each of its listeners can carry a Customer Tag that attributes the records arriving on it. See Syslog Import for the protocol options and Syslog Ports for the listener configuration. Either TLS listener presents a certificate the sending device has to trust: the Download CA (ca.crt) button on the Syslog Ports page supplies it, and without it the handshake fails with nothing logged on the platform side. For a fleet of servers, a local collector is normally the right aggregation point rather than pointing every host at the cloud endpoint.

What the shipped parser actually keeps

The reference parser recognises two message families only: sshd and audispd. Other rsyslog traffic — cron, systemd unit changes, package installs, kernel messages — arrives but is not parsed into fields. Privilege escalation therefore shows up through the auditd stream via audispd, not as a plain syslog sudo line, so forward auditd if sudo activity matters to you.

Install the Application​

Go to Platform → Applications → Install Application From Template and choose Linux (RHEL) Syslog from the On-Premise IT category, then press Install. The template takes no parameters: it supplies the parser and builds the pipeline, and the transport is configured on the syslog listener rather than on the form. There is no source to add, no processor to attach, and no sink to wire by hand.

Setup New Linux (RHEL) Syslog Application panel