mrcharles
06679d9a0c
deploy-agent.sh (Ubuntu VMs) + deploy-rsyslog.sh (PVE hosts, TCP/514 via Tailscale). Landed: agents on netinfra-01/02, librenms, awx (7 total active on manager); rsyslog forwarding verified on all 7 PVE hosts (persistent 514 sessions on the manager). Deferred: k8s nodes (k8s-chat coordination), docker json-log caps (needs daemon restart window). Meat + verification: https://projects.knownelement.com/issues/335#note-4006
31 lines
975 B
Bash
31 lines
975 B
Bash
#!/bin/bash
|
|
#
|
|
# deploy-rsyslog.sh — rsyslog forwarding to Wazuh for PVE hosts [#335]
|
|
# Run as root on the target host. Idempotent; safe to re-run.
|
|
# Forwards everything via TCP/514 to tsys-wazuh.knel.net (Tailscale
|
|
# overlay; manager allowlist = 100.64.0.0/10). journald stays the local SoR.
|
|
#
|
|
set -euo pipefail
|
|
|
|
MGR="tsys-wazuh.knel.net"
|
|
|
|
if ! dpkg -s rsyslog >/dev/null 2>&1; then
|
|
echo "installing rsyslog"
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y rsyslog
|
|
fi
|
|
|
|
F=/etc/rsyslog.d/90-forward-wazuh.conf
|
|
if [ ! -f "$F" ]; then
|
|
printf '# Wazuh syslog forwarding (Tailscale overlay) [#335]\n*.* @@%s:514\n' "$MGR" > "$F"
|
|
echo "forward rule installed"
|
|
else
|
|
echo "forward rule already present"
|
|
fi
|
|
|
|
systemctl enable --now rsyslog >/dev/null 2>&1 || true
|
|
systemctl restart rsyslog
|
|
sleep 2
|
|
systemctl -q is-active rsyslog && echo "rsyslog ACTIVE"
|
|
logger -p auth.warning "wazuh-trail-test host=$(hostname) stamp=$(date +%s)"
|
|
echo "trail event sent from $(hostname)"
|